linux-kernel - Re: [BUG] md: race between bitmap_daemon_work and __bitmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMGffEkvZUAgjxYSPL39tfDhWqxZB-o-zbe-rrMAPeuQ0vr4fA@mail.gmail.com>
Date: Mon, 19 Jan 2026 20:05:11 +0100
From: Jinpu Wang <jinpu.wang@...os.com>
To: yukuai@...as.com
Cc: linux-raid <linux-raid@...r.kernel.org>, Song Liu <song@...nel.org>, 
	open list <linux-kernel@...r.kernel.org>
Subject: Re: [BUG] md: race between bitmap_daemon_work and __bitmap_resize
 leading to use-after-free

Hi Kuai,

On Mon, Jan 19, 2026 at 5:44 PM Yu Kuai <yukuai@...as.com> wrote:
>
> Hi,
>
> 在 2026/1/19 23:14, Jinpu Wang 写道:
> > We are looking for suggestions on the best way to synchronize this. It
> > seems we need to either: a) Ensure the md thread's daemon work is
> > stopped/flushed before
> >
> > __bitmap_resize proceeds with unmapping. b) Protect bitmap->storage
> > replacement with a lock that
> > bitmap_daemon_work also respects.
> >
> > Any thoughts on the preferred approach?
>
> create/free/resize and access bitmap other than IO path should all be
> protected with mddev->bitmap_info.mutex.

Thx for the suggestion, I will work on a fix.
>
> --
> Thansk,
> Kuai
Jinpu