Re: [PATCH] ACPI: APEI: check return value of task_work_add to prevent memory leaks

[mawupeng <mawupeng1@huawei.com>]

On 周二 2026-4-21 17:02, Hanjun Guo wrote:
> Hi Wupeng,
> 
> On 2026/4/17 14:50, Wupeng Ma wrote:
>> task_work_add() can fail with -ESRCH if the target task is exiting.
>> When it fails, the caller must handle the error and free any allocated
>> resources.
>>
>> ghes_do_memory_failure() allocates a twcb structure from ghes_estatus_pool
>> before calling task_work_add(). If task_work_add() fails, twcb is leaked.
>>
>> This can happen due to a race during task exit:
>>
>>    do_exit()
>>      exit_mm()           # current->mm cleared
>>      exit_task_work()    # task->task_works = &work_exited
>>
>> ghes_do_memory_failure() checks current->mm before allocating twcb,
>> but exit_task_work() may run before task_work_add() completes.  At that
>> point task->task_works == &work_exited, causing task_work_add() to fail.
> 
> There are multi places in the kernel to call task_work_add() without
> checking the return value, does this race only cause bug in
> ghes_do_memory_failure()?

Thanks for the review. 

We have analyzed all the called functions, and apart from this location, only
binder_deferred_fd_close has a potential resource leak issue upon failure.


> 
> Thanks
> Hanjun