Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
MIME-Version: 1.0
References: <c64d2143-284e-7621-440c-971e3405b4d8@virtuozzo.com>
 <d209a0b1-2514-79a0-257a-22bcb372785a@virtuozzo.com> <1d287c7e-8aff-beea-1bd6-4b2226f9f3db@opensource.wdc.com>
In-Reply-To: <1d287c7e-8aff-beea-1bd6-4b2226f9f3db@opensource.wdc.com>
From:   Mike Snitzer <snitzer@redhat.com>
Date:   Tue, 22 Feb 2022 22:02:51 -0500
Message-ID: <CAH6w=ayrR0yRCumgjtyB+mt_+33S6PHxBQDcwYVcuQ79ECYd7A@mail.gmail.com>
Subject: Re: [PATCH RESEND v2] dm: Fix use-after-free in dm_cleanup_zoned_dev()
To:     Damien Le Moal <damien.lemoal@opensource.wdc.com>
Cc:     Kirill Tkhai <ktkhai@virtuozzo.com>,
        "agk@redhat.com" <agk@redhat.com>,
        "dm-devel@redhat.com" <dm-devel@redhat.com>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Thu, Feb 17, 2022 at 5:49 AM Damien Le Moal
<damien.lemoal@opensource.wdc.com> wrote:
>
> On 2/17/22 19:13, Kirill Tkhai wrote:
> >
> > dm_cleanup_zoned_dev() uses queue, so it must be called
> > before blk_cleanup_disk() starts its killing:
> >
> > blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->
> > ->...RCU...->blk_free_queue_rcu()->kmem_cache_free()
> >
> > Otherwise, RCU callback may be executed first,
> > and dm_cleanup_zoned_dev() touches freed memory:
>
> Mike,
>
> Can you queue this please ?

I queued it earlier today, please see:
https://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git/commit/?h=dm-5.18&id=588b7f5df0cb64f281290c7672470c006abe7160

Thanks,
Mike