[PATCH] dm-raid: fix use-after-free in raid_dtr()

[Li Youhong]

From: Li Youhong <liyouhong@xxxxxxxxxx>

raid_dtr() currently flushes event_work only if work_pending() is true.
This is insufficient because once a worker has dequeued the work, the
PENDING bit is cleared while do_table_event() is still running. In that
window raid_set_free() can free the raid_set, leading to a
use-after-free when do_table_event() accesses rs->ti->table.

Flush event_work whenever it has been initialized, so raid_set is not
freed while the event handler is still running. The .func guard skips the
flush for mddev instances where INIT_WORK has not run yet.

Fixes: db29d79b34d9 ("dm-raid: delay flushing event_work() after reconfig_mutex is released")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Li Youhong <liyouhong@xxxxxxxxxx>
---
v2: 
- Fix incorrect Fixes tag; the work_pending() check in raid_dtr() was
  introduced by db29d79b34d9, not a17d1bca5aba.
- v1: https://lore.kernel.org/all/20261112075741.1449168-1-dayou5941@xxxxxxx/

 drivers/md/dm-raid.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index ac019a0f5a92..c1f546e8c65d 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3340,7 +3340,7 @@ static void raid_dtr(struct dm_target *ti)
 	rs->md.dm_gendisk = NULL;
 	mddev_unlock(&rs->md);
 
-	if (work_pending(&rs->md.event_work))
+	if (rs->md.event_work.func)
 		flush_work(&rs->md.event_work);
 	raid_set_free(rs);
 }
 
-- 
2.25.1