| From 44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5 Mon Sep 17 00:00:00 2001 |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| Date: Mon, 27 Jul 2026 22:26:36 +0200 |
| Subject: dm: fix resume-vs-remove race |
| |
| From: Mikulas Patocka <mpatocka@redhat.com> |
| |
| commit 44b43ec132f1cf3275ecc182d0c82f50c3c4c3d5 upstream. |
| |
| If the user issues the resume ioctl and the remove ioctl at the same |
| time, it may be possible that the device is resumed after it is suspended |
| in __dm_destroy. The result is that the table is destroyed without |
| calling the postsuspend method. |
| |
| Dm targets expect that they may be removed only after the postsuspend |
| method method was called. If we break this expectation, it can cause |
| misbehavior in various targets. For example - in the dm-integrity target, |
| the reboot notifier is not unregistered, leading to use-after-free. |
| |
| Fix this bug by refusing to resume if the device is being destroyed. |
| |
| Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/md/dm.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/md/dm.c |
| +++ b/drivers/md/dm.c |
| @@ -2852,7 +2852,7 @@ retry: |
| r = -EINVAL; |
| mutex_lock_nested(&md->suspend_lock, SINGLE_DEPTH_NESTING); |
| |
| - if (!dm_suspended_md(md)) |
| + if (!dm_suspended_md(md) || test_bit(DMF_FREEING, &md->flags)) |
| goto out; |
| |
| if (dm_suspended_internally_md(md)) { |
