Patch "dm-delay: fix workqueue delay_timer race" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    dm-delay: fix workqueue delay_timer race

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     dm-delay-fix-workqueue-delay_timer-race.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c16fad1e8e5abdf96db76c406ef7b8528020c01b
Author: Benjamin Marzinski <bmarzins@xxxxxxxxxx>
Date:   Tue May 7 17:16:23 2024 -0400

    dm-delay: fix workqueue delay_timer race
    
    [ Upstream commit 8d24790ed08ab4e619ce58ed4a1b353ab77ffdc5 ]
    
    delay_timer could be pending when delay_dtr() is called. It needs to be
    shut down before kdelayd_wq is destroyed, so it won't try queueing more
    work to kdelayd_wq while that's getting destroyed.
    
    Also the del_timer_sync() call in delay_presuspend() doesn't protect
    against the timer getting immediately rearmed by the queued call to
    flush_delayed_bios(), but there's no real harm if that does happen.
    timer_delete() is less work, and is basically just as likely to stop a
    pointless call to flush_delayed_bios().
    
    Fixes: 26b9f228703f ("dm: delay target")
    Signed-off-by: Benjamin Marzinski <bmarzins@xxxxxxxxxx>
    Signed-off-by: Mike Snitzer <snitzer@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
index 5eabdb06c6498..eec0daa4b227a 100644
--- a/drivers/md/dm-delay.c
+++ b/drivers/md/dm-delay.c
@@ -154,8 +154,10 @@ static void delay_dtr(struct dm_target *ti)
 {
 	struct delay_c *dc = ti->private;
 
-	if (dc->kdelayd_wq)
+	if (dc->kdelayd_wq) {
+		timer_shutdown_sync(&dc->delay_timer);
 		destroy_workqueue(dc->kdelayd_wq);
+	}
 
 	if (dc->read.dev)
 		dm_put_device(ti, dc->read.dev);
@@ -335,7 +337,7 @@ static void delay_presuspend(struct dm_target *ti)
 	mutex_unlock(&delayed_bios_lock);
 
 	if (!delay_is_fast(dc))
-		del_timer_sync(&dc->delay_timer);
+		timer_delete(&dc->delay_timer);
 	flush_delayed_bios(dc, true);
 }