Re: [PATCH] dm-raid: fix use-after-free in raid_dtr()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] dm-raid: wrong Fixes trailer citing a17d1bca5aba instead of
  db29d79b34d9
--

commit ea394970c807037990938dd90a475a2a71496a69
Author: Li Youhong <liyouhong@kylinos.cn>

> dm-raid: fix use-after-free in raid_dtr()
>
> raid_dtr() currently flushes event_work only if work_pending() is true.
> This is insufficient because once a worker has dequeued the work, the
> PENDING bit is cleared while do_table_event() is still running. In that
> window raid_set_free() can free the raid_set, leading to a
> use-after-free when do_table_event() accesses rs->ti->table.
>
> Flush event_work whenever it has been initialized, so raid_set is not
> freed while the event handler is still running. The .func guard skips the
> flush for mddev instances where INIT_WORK has not run yet.
>
> Fixes: a17d1bca5aba ("md: fix stopping sync thread")
> Cc: stable@vger.kernel.org
> Signed-off-by: Li Youhong <liyouhong@kylinos.cn>

[Severity: Low]
Commit a17d1bca5aba ("md: fix stopping sync thread") is a stable backport
of f52f5c71f3d4 ("md: fix stopping sync thread"), which only touched
stop_sync_thread() in drivers/md/md.c.  The work_pending() check on
rs->md.event_work in raid_dtr() was introduced by db29d79b34d9 ("dm-raid:
delay flushing event_work() after reconfig_mutex is released").

Should the Fixes tag be:

  Fixes: db29d79b34d9 ("dm-raid: delay flushing event_work() after reconfig_mutex is released")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112075741.1449168-1-dayou5941@163.com?part=1