[PATCH] dm-raid: fix use-after-free in raid_dtr()

[PATCH] dm-raid: fix use-after-free in raid_dtr()

[Li Youhong]

From: Li Youhong <liyouhong@kylinos.cn>

raid_dtr() currently flushes event_work only if work_pending() is true.
This is insufficient because once a worker has dequeued the work, the
PENDING bit is cleared while do_table_event() is still running. In that
window raid_set_free() can free the raid_set, leading to a
use-after-free when do_table_event() accesses rs->ti->table.

Flush event_work whenever it has been initialized, so raid_set is not
freed while the event handler is still running. The .func guard skips the
flush for mddev instances where INIT_WORK has not run yet.

Fixes: db29d79b34d9 ("dm-raid: delay flushing event_work() after reconfig_mutex is released")
Cc: stable@vger.kernel.org
Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
---
v2: 
- Fix incorrect Fixes tag; the work_pending() check in raid_dtr() was
  introduced by db29d79b34d9, not a17d1bca5aba.
- v1: https://lore.kernel.org/all/20261112075741.1449168-1-dayou5941@163.com/

 drivers/md/dm-raid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index ac019a0f5a92..c1f546e8c65d 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3340,7 +3340,7 @@ static void raid_dtr(struct dm_target *ti)
 	rs->md.dm_gendisk = NULL;
 	mddev_unlock(&rs->md);
 
-	if (work_pending(&rs->md.event_work))
+	if (rs->md.event_work.func)
 		flush_work(&rs->md.event_work);
 	raid_set_free(rs);
 }
 
-- 
2.25.1

Re: [PATCH] dm-raid: fix use-after-free in raid_dtr()

[Mikulas Patocka]

OK. I applied the patch, thanks.

Mikulas


On Thu, 12 Nov 2026, Li Youhong wrote:

> From: Li Youhong <liyouhong@kylinos.cn>
> 
> raid_dtr() currently flushes event_work only if work_pending() is true.
> This is insufficient because once a worker has dequeued the work, the
> PENDING bit is cleared while do_table_event() is still running. In that
> window raid_set_free() can free the raid_set, leading to a
> use-after-free when do_table_event() accesses rs->ti->table.
> 
> Flush event_work whenever it has been initialized, so raid_set is not
> freed while the event handler is still running. The .func guard skips the
> flush for mddev instances where INIT_WORK has not run yet.
> 
> Fixes: db29d79b34d9 ("dm-raid: delay flushing event_work() after reconfig_mutex is released")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
> ---
> v2: 
> - Fix incorrect Fixes tag; the work_pending() check in raid_dtr() was
>   introduced by db29d79b34d9, not a17d1bca5aba.
> - v1: https://lore.kernel.org/all/20261112075741.1449168-1-dayou5941@163.com/
> 
>  drivers/md/dm-raid.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
> index ac019a0f5a92..c1f546e8c65d 100644
> --- a/drivers/md/dm-raid.c
> +++ b/drivers/md/dm-raid.c
> @@ -3340,7 +3340,7 @@ static void raid_dtr(struct dm_target *ti)
>  	rs->md.dm_gendisk = NULL;
>  	mddev_unlock(&rs->md);
>  
> -	if (work_pending(&rs->md.event_work))
> +	if (rs->md.event_work.func)
>  		flush_work(&rs->md.event_work);
>  	raid_set_free(rs);
>  }
>  
> -- 
> 2.25.1
> 

[PATCH] dm-raid: fix use-after-free in raid_dtr()

[Li Youhong]

From: Li Youhong <liyouhong@kylinos.cn>

raid_dtr() currently flushes event_work only if work_pending() is true.
This is insufficient because once a worker has dequeued the work, the
PENDING bit is cleared while do_table_event() is still running. In that
window raid_set_free() can free the raid_set, leading to a
use-after-free when do_table_event() accesses rs->ti->table.

Flush event_work whenever it has been initialized, so raid_set is not
freed while the event handler is still running. The .func guard skips the
flush for mddev instances where INIT_WORK has not run yet.

Fixes: a17d1bca5aba ("md: fix stopping sync thread")
Cc: stable@vger.kernel.org
Signed-off-by: Li Youhong <liyouhong@kylinos.cn>
---
 drivers/md/dm-raid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index ac019a0f5a92..c1f546e8c65d 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3340,7 +3340,7 @@ static void raid_dtr(struct dm_target *ti)
 	rs->md.dm_gendisk = NULL;
 	mddev_unlock(&rs->md);
 
-	if (work_pending(&rs->md.event_work))
+	if (rs->md.event_work.func)
 		flush_work(&rs->md.event_work);
 	raid_set_free(rs);
 }
 
-- 
2.25.1