linux-kernel - [PATCH] dm-thin: Fix race condition when destroying thin pool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 17 Dec 2015 18:03:35 +0200
From:	Nikolay Borisov <kernel@...p.com>
To:	snitzer@...hat.com
Cc:	agk@...hat.com, dm-devel@...hat.com, operations@...eground.com,
	linux-kernel@...r.kernel.org, ejt@...hat.com, tj@...nel.org,
	<stable@...r.kernel.org>
Subject: [PATCH] dm-thin: Fix race condition when destroying thin pool

When a thin pool is being destroyed delayed work items are
canceled using cancel_delayed_work item, which doesn't
guarantee that on return the delayed item wasn't running. This
can cause the workitem to requeue itself on an already destroyed
workqueue. Fix this by using cancel_delayed_work item which
guarantees that on return the workitem is not running anymore.

Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second")
Fixes: 85ad643b7e7e52 ("dm thin: add timeout to stop out-of-data-space 
mode holding IO forever")
Signed-off-by: Nikolay Borisov <kernel@...p.com>
Cc: <stable@...r.kernel.org>

---
 drivers/md/dm-thin.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 63903a5a5d9e..a1cc797fe88f 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3453,8 +3453,8 @@ static void pool_postsuspend(struct dm_target *ti)
 	struct pool_c *pt = ti->private;
 	struct pool *pool = pt->pool;
 
-	cancel_delayed_work(&pool->waker);
-	cancel_delayed_work(&pool->no_space_timeout);
+	cancel_delayed_work_sync(&pool->waker);
+	cancel_delayed_work_sync(&pool->no_space_timeout);
 	flush_workqueue(pool->wq);
 	(void) commit(pool);
 }
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/