diff mbox series

[v2,4/4] dm integrity: Fix UAF in dm_integrity_dtr()

Message ID 20221129024850.1842973-5-luomeng12@huawei.com (mailing list archive)
State Accepted, archived
Delegated to: Mike Snitzer
Headers show
Series dm: Fix UAF in run_timer_softirq() | expand

Commit Message

Luo Meng Nov. 29, 2022, 2:48 a.m. UTC 
Dm_integrity also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.

Therefore, canceling timer again in dm_integrity_dtr().

Fixes: 7eada909bfd7a (dm: add integrity target)
Signed-off-by: Luo Meng <luomeng12@huawei.com>
---
 drivers/md/dm-integrity.c | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index e97e9f97456d..1388ee35571e 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -4558,6 +4558,8 @@  static void dm_integrity_dtr(struct dm_target *ti)
 	BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
 	BUG_ON(!list_empty(&ic->wait_list));
 
+	if (ic->mode == 'B')
+		cancel_delayed_work_sync(&ic->bitmap_flush_work);
 	if (ic->metadata_wq)
 		destroy_workqueue(ic->metadata_wq);
 	if (ic->wait_wq)