From: Li Nan <linan122@huawei.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/4577 CVE: CVE-2024-35808 Reference: https://lore.kernel.org/all/20240601090608.2847814-1-linan666@huaweicloud.co... -------------------------------- MD_RECOVERY_FROZEN should always remain set after array is frozen. But in raid_message(), this flag is cleared soon after frozen. Fix it. This flag will be cleared in md_idle_sync_thread(), there is no need to clear it again for idle. Fixes: cd32b27a66db ("md/dm-raid: don't call md_reap_sync_thread() directly") Signed-off-by: Li Nan <linan122@huawei.com> --- drivers/md/dm-raid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index dc2341a1a0e4..439c5a92f77d 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3744,9 +3744,10 @@ static int raid_message(struct dm_target *ti, unsigned int argc, char **argv, md_idle_sync_thread(mddev); mddev_unlock(mddev); + } else { + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); } - clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); if (decipher_sync_action(mddev, mddev->recovery) != st_idle) return -EBUSY; else if (!strcasecmp(argv[0], "resync")) -- 2.39.2