Re: [PATCH] dm-raid: fix use-after-free in raid_dtr()

[Mikulas Patocka <mpatocka@redhat.com>]

OK. I applied the patch, thanks.

Mikulas


On Thu, 12 Nov 2026, Li Youhong wrote:

> From: Li Youhong <liyouhong@kylinos.cn>
> 
> raid_dtr() currently flushes event_work only if work_pending() is true.
> This is insufficient because once a worker has dequeued the work, the
> PENDING bit is cleared while do_table_event() is still running. In that
> window raid_set_free() can free the raid_set, leading to a
> use-after-free when do_table_event() accesses rs->ti->table.
> 
> Flush event_work whenever it has been initialized, so raid_set is not
> freed while the event handler is still running. The .func guard skips the
> flush for mddev instances where INIT_WORK has not run yet.
> 
> Fixes: db29d79b34d9 ("dm-raid: delay flushing event_work() after reconfig_mutex is released")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
> ---
> v2: 
> - Fix incorrect Fixes tag; the work_pending() check in raid_dtr() was
>   introduced by db29d79b34d9, not a17d1bca5aba.
> - v1: https://lore.kernel.org/all/20261112075741.1449168-1-dayou5941@163.com/
> 
>  drivers/md/dm-raid.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
> index ac019a0f5a92..c1f546e8c65d 100644
> --- a/drivers/md/dm-raid.c
> +++ b/drivers/md/dm-raid.c
> @@ -3340,7 +3340,7 @@ static void raid_dtr(struct dm_target *ti)
>  	rs->md.dm_gendisk = NULL;
>  	mddev_unlock(&rs->md);
>  
> -	if (work_pending(&rs->md.event_work))
> +	if (rs->md.event_work.func)
>  		flush_work(&rs->md.event_work);
>  	raid_set_free(rs);
>  }
>  
> -- 
> 2.25.1
>