[Devel] [PATCH hci-8.1 v5 09/11] dm-ploop: fix use-after-free on the last inflight_md decrement

[no-reply at sashiko.virtuozzo.com]

> The last piwb reference is often dropped from the BAT write completion
> in aio context. ploop_bat_write_finish() completes the data pios there,
> and once the last original request is done, suspend can finish and a
> table reload or remove can free the ploop in ploop_destroy(). The
> completing CPU still decrements inflight_md, calls wake_up() on
> inflight_md_wq and frees the piwb into ploop->pio_pool, so it can lock
> a freed waitqueue or free into a destroyed mempool.
> 
> Nothing on the suspend or destroy path waits for inflight_md, and the
> one waiter that exists, ploop_suspend_submitting_pios(), checks the
> counter without a lock. It can see zero and return before wake_up() and
> ploop_free_piwb() are done with the ploop, so the message can finish
> and the table can be destroyed under the waker.
> 
> Free the piwb first, then decrement inflight_md and wake the waiters
> under inflight_md_wq.lock as the last access to the ploop. Have the
> waiters take the same lock once they see zero, so they cannot proceed
> until the waker has released it, and wait for it in ploop_destroy()
> before freeing anything.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-148171
> Feature: dm-ploop: ploop target driver
> 
> Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261013075513.90618-1-alexander.ivanov@virtuozzo.com?part=9