projects
/
linux-2.6-block.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
e4b5957
)
dm cache: Fix UAF in destroy()
author
Luo Meng
<luomeng12@huawei.com>
Tue, 29 Nov 2022 02:48:49 +0000
(10:48 +0800)
committer
Mike Snitzer
<snitzer@kernel.org>
Wed, 30 Nov 2022 18:29:34 +0000
(13:29 -0500)
Dm_cache also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.
Therefore, cancelling timer again in destroy().
Cc: stable@vger.kernel.org
Fixes:
c6b4fcbad044e
("dm: add cache target")
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
drivers/md/dm-cache-target.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/md/dm-cache-target.c
b/drivers/md/dm-cache-target.c
index 54a8d5c9a44ea4814083bb617309598307fa8764..624a6335c8323d391ec6e61e343233934aa9bcba 100644
(file)
--- a/
drivers/md/dm-cache-target.c
+++ b/
drivers/md/dm-cache-target.c
@@
-1887,6
+1887,7
@@
static void destroy(struct cache *cache)
if (cache->prison)
dm_bio_prison_destroy_v2(cache->prison);
+ cancel_delayed_work_sync(&cache->waker);
if (cache->wq)
destroy_workqueue(cache->wq);