[Devel] [PATCH RH9] dm: Fix use-after-free in dm_cleanup_zoned_dev()

[Cyrill Gorcunov]

On Tue, Feb 01, 2022 at 11:43:36AM +0300, Kirill Tkhai wrote:
> dm_cleanup_zoned_dev() uses queue, so it must be called
> before blk_cleanup_disk() starts its killing:
> 
> blk_cleanup_disk->blk_cleanup_queue()->kobject_put()->blk_release_queue()->
> ->...RCU...->blk_free_queue_rcu()->kmem_cache_free()
> 
> Otherwise, RCU callback may be executed first, and dm_cleanup_zoned_dev()
> touches freed memory. See full KASAN trace in #PSBM-138227.
> 
> https://jira.sw.ru/browse/PSBM-138227
> Signed-off-by: Kirill Tkhai <ktkhai at virtuozzo.com>
Tested-by: Cyrill Gorcunov <gorcunov at virtuozzo.com>