From nobody Sat Jun 13 07:51:40 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0CB2280338 for ; Fri, 8 May 2026 16:22:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778257337; cv=none; b=iPj9lYT5dE5RFUvFwyTttQD9MUfrGvihBmo+jd0i9rxeZO8Fg5t2UqY1PXhhS9ZSfbYIlTnxPZ4Dw5GLY5slcvJLSqPY5nrsCsK6avS3gtU01cn37yegJX6DrVPtPhRR5Vdy3/rCZIzW3gTKxoYkcpHpk4kVtYn1Lai8zlIMgis= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778257337; c=relaxed/simple; bh=nGzvzYKb8E8+4wFVv7TaWSy9iTOGW9+PxwEWo6PBFBE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=bKcK6c/796l3IfXa4eVXLdIVW0NgrPC8u5u9ms+fomw+q3FkTtJszMjvjk+3tdbyozSOGtERp8FSU9/hq4SM9BN0NBhazOiGQmEj6gakx2GNMDL8dplBBW+9lRbiXPO0GPlwJymDmsW9eSB9P3AUVM2SKsDJzi+RPRjELGysDcY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=Y4ZfGRkn; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="Y4ZfGRkn" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From: Reply-To:Content-ID:Content-Description:In-Reply-To:References; bh=fsrrUvUzLiTKs1/TwrCdmlJ/go+so4rnMJMQNRbk1JE=; b=Y4ZfGRknfF+JD0vnYXNJDxFozG 5kww3QQ6W1O5uYqQmBJCBWUvJqGNyO0MGTP8iE93BSSf9I+iM548cM6OF+mri08GIItf0UKxIq/oW tO5+RF6lnwM/uDc5itSmzQsb+pBkjl5RNeTwXDwmwbhfVgpFIKqBAhaMu7NTwR1FcVoYbzTLQ7mEL sJ5Awhac8mUAtS2BvvhjqQIUMdIZe2viwWtjfCPsfn2l+NOf7PTrn0V8evrFKAZwlTz1jlH1I13Ot LILwlRl06TNJmKjtNZv7Rc1anVuwBYC4oYPAIml2Hy9SkDnyAstk7gN9MGTKYSFRoeISqpTp7Dd7w vzduxQvA==; Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wLNxr-005Gud-0k; Fri, 08 May 2026 16:22:11 +0000 From: Breno Leitao Date: Fri, 08 May 2026 09:22:03 -0700 Subject: [PATCH] workqueue: fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260508-wq_leak-v1-1-4fe76e5c004e@debian.org> X-B4-Tracking: v=1; b=H4sIAKoN/mkC/6tWKk4tykwtVrJSqFYqSi3LLM7Mz1OyUjDUUVBKz kjMS0/VzUxRslJQMjIwMjMwNbDQLS+Mz0lNzNY1SzaxSDU3MkpKSTZS0lFQKihKTcusAJsUHQv hF5cmZaUml4C0K9XWAgCu657dawAAAA== X-Change-ID: 20260508-wq_leak-6c48e722bdc2 To: Tejun Heo , Lai Jiangshan , Dennis Dalessandro Cc: linux-kernel@vger.kernel.org, kernel-team@meta.com, stable@kernel.org, Breno Leitao X-Mailer: b4 0.16-dev-453a6 X-Developer-Signature: v=1; a=openpgp-sha256; l=1626; i=leitao@debian.org; h=from:subject:message-id; bh=nGzvzYKb8E8+4wFVv7TaWSy9iTOGW9+PxwEWo6PBFBE=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBp/g2uOC07gVMztp58AROZSxumhiUQRm5VALqn9 XVzeuzyHwqJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaf4NrgAKCRA1o5Of/Hh3 bfiKEACH9cvxlwe42fB1Q2HPx4lFWHLSwtjdu/B+wRUt4kcN3N8gHQInRxdS7vcCnNT5Xv44axN L4UStFoc+oE9v3PBiPFhrAzAeA3c0dihWSO62VLtxy8Z5ekwBqMoC/p8gbidWoYkd5Ia30ba4Jx xV6RNos6eK0s7ZkW3EgE1vp4KW2/fxNI35trGEcpNftBoNZGjEnq3kr2WFnRIbLnBK8K17JO8we pLxdHLoNGV+pFbuXHO74Oc4MkHiOdYyenJ2mO3y+QDeqgJK3Co/3bbAqatA0BA9feM+nfkyV5O7 mjBsDOHwNmkB8RLsyitktxilPSme9CqNvlVl8zg0l0fa1jeYXzsuG7Obo6PyUP00vVZR+do/ToG /XEzySKi8sU4KFnfR7WKDKbpRI7SS/X1qTVxJ17JwHlZOAXpBttsRPscX6tLGYqDruMD8AMbs4N pFhU5XO+LhN5RZ/pTsRCY+4rXoJGxPcfn/8lh8Iiu7Gcykv7H/JXC9/9grWfMZ4ExgjZ0z8C6xg W/Jej/zJSO4EcHijX5ZSjn5mzct2pvDefdNo5Dmot0tRa6ARNTIuYZSvwgZxqgLj7dVFKPMIuo0 QC5Uf7448rmPuNelTDonlDU5u9anCbpTJMtZANQe600BVod3fAO8+JX6r5DrGF75vfIrTR4xVsq pMiy5keECsmk8zg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao For WQ_UNBOUND workqueues, alloc_and_link_pwqs() allocates wq->cpu_pwq via alloc_percpu() and then calls apply_workqueue_attrs_locked(). On failure it returns the error directly, bypassing the enomem: label which holds the only free_percpu(wq->cpu_pwq) in this function. The caller's error path kfree()s wq without touching wq->cpu_pwq, leaking one percpu pointer table (nr_cpu_ids * sizeof(void *) bytes) per failed call. If kmemleak is enabled, we can see: unreferenced object (percpu) 0xc0fffa5b121048 (size 8): comm "insmod", pid 776, jiffies 4294682844 backtrace (crc 0): pcpu_alloc_noprof+0x665/0xac0 __alloc_workqueue+0x33f/0xa20 alloc_workqueue_noprof+0x60/0x100 Route the error through the existing enomem: cleanup and any error before this one. Cc: stable@kernel.org Fixes: 636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu poo= l_workqueues") Signed-off-by: Breno Leitao --- kernel/workqueue.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 3d2e3b2ec5283..3b839ddf2fdd2 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -5642,7 +5642,9 @@ static int alloc_and_link_pwqs(struct workqueue_struc= t *wq) ret =3D apply_workqueue_attrs_locked(wq, unbound_std_wq_attrs[highpri]); } =20 - return ret; + if (ret) + goto enomem; + return 0; =20 enomem: if (wq->cpu_pwq) { --- base-commit: fcee7d82f27d6a8b1ddc5bbefda59b4e441e9bc0 change-id: 20260508-wq_leak-6c48e722bdc2 Best regards, -- =20 Breno Leitao