linux-kernel - Re: [BUG] md: race between bitmap_daemon_work and __bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <b1824ba1-a051-4c4f-bbf9-c28fb225edfc@fnnas.com>
Date: Tue, 20 Jan 2026 00:44:02 +0800
From: "Yu Kuai" <yukuai@...as.com>
To: "Jinpu Wang" <jinpu.wang@...os.com>, 
	"linux-raid" <linux-raid@...r.kernel.org>, "Song Liu" <song@...nel.org>, 
	"open list" <linux-kernel@...r.kernel.org>, <yukuai@...as.com>
Subject: Re: [BUG] md: race between bitmap_daemon_work and __bitmap_resize leading to use-after-free

Hi,

在 2026/1/19 23:14, Jinpu Wang 写道:
> We are looking for suggestions on the best way to synchronize this. It
> seems we need to either: a) Ensure the md thread's daemon work is
> stopped/flushed before
>
> __bitmap_resize proceeds with unmapping. b) Protect bitmap->storage
> replacement with a lock that
> bitmap_daemon_work also respects.
>
> Any thoughts on the preferred approach?

create/free/resize and access bitmap other than IO path should all be
protected with mddev->bitmap_info.mutex.

-- 
Thansk,
Kuai