Jack Wang 46ef85f854 md/bitmap: fix GPF in write_page caused by resize race ...

A General Protection Fault occurs in write_page() during array resize:
RIP: 0010:write_page+0x22b/0x3c0 [md_mod]

This is a use-after-free race between bitmap_daemon_work() and
__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`
without locking, while the resize path frees that storage via
md_bitmap_file_unmap(). `quiesce()` does not stop the md thread,
allowing concurrent access to freed pages.

Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.

Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com
Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u
Cc: stable@vger.kernel.org
Fixes: d60b479d17 ("md/bitmap: add bitmap_resize function to allow bitmap resizing.")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>

2026-01-26 13:36:06 +08:00

..

bcache

bcache: fix improper use of bi_end_io

2025-12-09 10:20:03 -07:00

dm-pcache

Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-12-11 12:13:29 +09:00

dm-vdo

Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-12-11 12:13:29 +09:00

persistent-data

lib/crc: remove CONFIG_LIBCRC32C

2025-04-04 11:31:42 -07:00

dm-audit.c

…

dm-audit.h

…

dm-bio-prison-v1.c

dm cache: Remove unused functions in bio-prison-v1

2024-11-20 11:38:04 +01:00

dm-bio-prison-v1.h

dm cache: Remove unused functions in bio-prison-v1

2024-11-20 11:38:04 +01:00

dm-bio-prison-v2.c

dm: use bio_list_merge_init

2024-04-01 11:53:37 -06:00

dm-bio-prison-v2.h

…

dm-bio-record.h

…

dm-bufio.c

dm-bufio: align write boundary on physical block size

2025-12-10 19:28:22 +01:00

dm-builtin.c

…

dm-cache-background-tracker.c

dm cache: Remove unused btracker_nr_writebacks_queued

2024-11-20 11:38:04 +01:00

dm-cache-background-tracker.h

dm cache: Remove unused btracker_nr_writebacks_queued

2024-11-20 11:38:04 +01:00

dm-cache-block-types.h

…

dm-cache-metadata.c

dm cache: Remove unused dm_cache_size

2024-11-20 11:38:04 +01:00

dm-cache-metadata.h

dm cache: Remove unused dm_cache_size

2024-11-20 11:38:04 +01:00

dm-cache-policy-internal.h

…

dm-cache-policy-smq.c

dm: use vmalloc_array() to simplify code

2025-08-19 11:12:50 +02:00

dm-cache-policy.c

…

dm-cache-policy.h

…

dm-cache-target.c

dm cache: support shrinking the origin device

2025-03-06 16:13:47 +01:00

dm-clone-metadata.c

dm: Make use of __assign_bit() API

2024-09-02 16:53:53 +02:00

dm-clone-metadata.h

…

dm-clone-target.c

block: add a bdev_limits helper

2024-10-29 09:15:00 -06:00

dm-core.h

dm: remove useless md->nr_zones variable

2025-10-20 15:21:56 +02:00

dm-crypt.c

dm-crypt: enable DM_TARGET_ATOMIC_WRITES

2025-12-10 19:28:22 +01:00

dm-delay.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

dm-dust.c

dm: Allow .prepare_ioctl to handle ioctls directly

2025-05-04 11:35:05 +02:00

dm-ebs-target.c

dm-ebs: Mark full buffer dirty even on partial write

2025-11-18 18:24:26 +01:00

dm-era-target.c

dm: Constify struct dm_block_validator

2024-07-19 12:08:15 +02:00

dm-exception-store.c

…

dm-exception-store.h

dm-snapshot: fix 'scheduling while atomic' on real-time kernels

2025-12-10 19:28:22 +01:00

dm-flakey.c

block: add a bio_init_inline helper

2025-09-09 07:31:59 -06:00

dm-ima.c

dm-ima: drop a useless argument

2025-08-19 11:12:50 +02:00

dm-ima.h

…

dm-init.c

dm init: Handle minors larger than 255

2024-07-02 20:53:41 +02:00

dm-integrity.c

Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-10-03 18:48:02 -07:00

dm-io-rewind.c

…

dm-io-tracker.h

…

dm-io.c

dm-io: Warn on creating multiple atomic write bios for a region

2025-01-17 22:24:09 +01:00

dm-ioctl.c

dm mpath: Interface for explicit probing of active paths

2025-05-04 11:35:06 +02:00

dm-kcopyd.c

dm io: Support IO priority

2024-02-20 14:22:51 -05:00

dm-linear.c

mm: remove callers of pfn_t functionality

2025-07-09 22:42:19 -07:00

dm-log-userspace-base.c

dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list

2024-02-20 14:22:55 -05:00

dm-log-userspace-transfer.c

…

dm-log-userspace-transfer.h

…

dm-log-writes.c

dm log-writes: Add missing set_freezable() for freezable kthread

2025-12-10 19:28:22 +01:00

dm-log.c

dm: update relevant MODULE_AUTHOR entries to latest dm-devel mailing list

2024-02-20 14:22:55 -05:00

dm-mpath.c

Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

2025-12-14 15:35:35 +12:00

dm-mpath.h

…

dm-path-selector.c

dm-mpath: make dm_unregister_path_selector return void

2025-06-30 16:20:04 +02:00

dm-path-selector.h

dm-mpath: make dm_unregister_path_selector return void

2025-06-30 16:20:04 +02:00

dm-ps-historical-service-time.c

dm-mpath: don't print the "loaded" message if registering fails

2025-06-30 16:20:17 +02:00

dm-ps-io-affinity.c

dm-mpath: make dm_unregister_path_selector return void

2025-06-30 16:20:04 +02:00

dm-ps-queue-length.c

dm-mpath: don't print the "loaded" message if registering fails

2025-06-30 16:20:17 +02:00

dm-ps-round-robin.c

dm-mpath: don't print the "loaded" message if registering fails

2025-06-30 16:20:17 +02:00

dm-ps-service-time.c

dm-mpath: don't print the "loaded" message if registering fails

2025-06-30 16:20:17 +02:00

dm-raid1.c

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08 09:07:37 +02:00

dm-raid.c

dm-raid: fix possible NULL dereference with undefined raid type

2025-12-10 19:28:22 +01:00

dm-region-hash.c

dm: use vmalloc_array() to simplify code

2025-08-19 11:12:50 +02:00

dm-rq.c

block: pass io_comp_batch to rq_end_io_fn callback

2026-01-20 10:12:54 -07:00

dm-rq.h

…

dm-snap-persistent.c

dm io: Support IO priority

2024-02-20 14:22:51 -05:00

dm-snap-transient.c

…

dm-snap.c

dm-snapshot: fix 'scheduling while atomic' on real-time kernels

2025-12-10 19:28:22 +01:00

dm-stats.c

dm stats: limit the number of entries

2024-01-30 14:06:44 -05:00

dm-stats.h

…

dm-stripe.c

dm-stripe: fix a possible integer overflow

2025-08-11 13:17:32 +02:00

dm-switch.c

dm: use vmalloc_array() to simplify code

2025-08-19 11:12:50 +02:00

dm-sysfs.c

dm: sysfs: use sysfs_emit() in dm-sysfs.c

2025-10-20 15:22:21 +02:00

dm-table.c

dm: Fix deadlock when reloading a multipath table

2025-10-20 15:26:57 +02:00

dm-target.c

dm error: mark as DM_TARGET_PASSES_INTEGRITY

2025-08-19 11:12:50 +02:00

dm-thin-metadata.c

dm: Constify struct dm_block_validator

2024-07-19 12:08:15 +02:00

dm-thin-metadata.h

…

dm-thin.c

dm: ignore discard return value

2025-12-10 19:28:22 +01:00

dm-uevent.c

…

dm-uevent.h

…

dm-unstripe.c

dm-unstriped: cast an operand to sector_t to prevent potential uint32_t overflow

2024-11-04 17:34:56 +01:00

dm-verity-fec.c

Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-12-11 12:13:29 +09:00

dm-verity-fec.h

dm-verity: remove useless mempool

2025-12-10 19:28:12 +01:00

dm-verity-loadpin.c

…

dm-verity-target.c

dm-verity: disable recursive forward error correction

2025-12-10 19:27:59 +01:00

dm-verity-verify-sig.c

dm-verity: fix a memory leak if some arguments are specified multiple times

2025-06-03 19:01:42 +02:00

dm-verity-verify-sig.h

…

dm-verity.h

dm-verity: use 2-way interleaved SHA-256 hashing when supported

2025-10-20 15:47:42 +02:00

dm-writecache.c

mm: remove callers of pfn_t functionality

2025-07-09 22:42:19 -07:00

dm-zero.c

dm: always manage discard support in terms of max_hw_discard_sectors

2024-05-20 15:51:19 -04:00

dm-zone.c

Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-12-11 12:13:29 +09:00

dm-zoned-metadata.c

dm: zoned: Remove unused functions

2024-11-20 11:38:04 +01:00

dm-zoned-reclaim.c

dm: Fix dm-zoned-reclaim zone write pointer alignment

2024-12-10 09:15:33 -07:00

dm-zoned-target.c

md: dm-zoned-target: Initialize return variable r to avoid uninitialized use

2025-07-31 15:39:55 +02:00

dm-zoned.h

dm: zoned: Remove unused functions

2024-11-20 11:38:04 +01:00

dm.c

Merge tag 'for-6.19/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-12-11 12:13:29 +09:00

dm.h

block: introduce disk_report_zone()

2025-11-05 08:07:21 -07:00

Kconfig

dm-verity: use SHA-256 library for SHA-256

2025-10-20 15:47:27 +02:00

Makefile

Merge tag 'for-6.18/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

2025-10-03 18:48:02 -07:00

md-autodetect.c

md: reintroduce md-linear

2025-01-13 07:36:29 -08:00

md-bitmap.c

md/bitmap: fix GPF in write_page caused by resize race

2026-01-26 13:36:06 +08:00

md-bitmap.h

md/md-llbitmap: introduce new lockless bitmap

2025-09-06 17:27:51 +08:00

md-cluster.c

Merge tag 'for-6.18/block-20250929' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

2025-10-02 10:16:56 -07:00

md-cluster.h

md: switch md-cluster to use md_submodle_head

2025-03-05 00:28:39 +08:00

md-linear.c

md: allow configuring logical block size

2025-11-11 11:20:15 +08:00

md-llbitmap.c

md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

2026-01-26 13:25:31 +08:00

md.c

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

md.h

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

raid0.c

md: merge mddev serialize_policy into mddev_flags

2026-01-26 13:10:51 +08:00

raid0.h

…

raid1-10.c

md/raid5: use mempool to allocate stripe_request_ctx

2026-01-26 13:11:29 +08:00

raid1.c

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

raid1.h

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

raid5-cache.c

md/raid5: remove redundant __GFP_NOWARN

2025-11-08 17:49:36 +08:00

raid5-log.h

…

raid5-ppl.c

md: rename recovery_cp to resync_offset

2025-07-31 01:26:04 +08:00

raid5.c

md/raid5: fix IO hang with degraded array with llbitmap

2026-01-26 13:18:59 +08:00

raid5.h

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

raid10.c

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00

raid10.h

md: remove recovery_disabled

2026-01-26 13:17:38 +08:00