| From 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa Mon Sep 17 00:00:00 2001 |
| From: Luo Meng <luomeng12@huawei.com> |
| Date: Tue, 29 Nov 2022 10:48:49 +0800 |
| Subject: dm cache: Fix UAF in destroy() |
| |
| From: Luo Meng <luomeng12@huawei.com> |
| |
| commit 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa upstream. |
| |
| Dm_cache also has the same UAF problem when dm_resume() |
| and dm_destroy() are concurrent. |
| |
| Therefore, cancelling timer again in destroy(). |
| |
| Cc: stable@vger.kernel.org |
| Fixes: c6b4fcbad044e ("dm: add cache target") |
| Signed-off-by: Luo Meng <luomeng12@huawei.com> |
| Signed-off-by: Mike Snitzer <snitzer@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/md/dm-cache-target.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| --- a/drivers/md/dm-cache-target.c |
| +++ b/drivers/md/dm-cache-target.c |
| @@ -2321,6 +2321,7 @@ static void destroy(struct cache *cache) |
| if (cache->prison) |
| dm_bio_prison_destroy(cache->prison); |
| |
| + cancel_delayed_work_sync(&cache->waker); |
| if (cache->wq) |
| destroy_workqueue(cache->wq); |
| |
