【OLK-5.10】执行fs_fusiontest测试套test_fs_fusion173用例，触发KASAN: use-after-free Write in run_timer_softirq

【严重程度】 一般
【特性】 文件系统
【重现类型】 有条件概率重现
【* 定位分析】
移除timer流程：

```
remove_all
  dm_lock_for_deletion
    set_bit(DMF_DELETING, &md->flags)
  dm_hash_remove_all
    dm_destroy
      __dm_destroy
set_bit(DMF_FREEING, &md->flags) #
       mutex_lock(&md->suspend_lock)
        if (!dm_suspended_md(md)) # 判断标记位md->flags 是否为DMF_SUSPENDED
dm_table_presuspend_targets
dm_table_postsuspend_targets
            pool_postsuspend
cancel_delayed_work_sync(&pool->waker) # TIMER链表删除
mutex_unlock(&md->suspend_lock);
dm_table_destroy
          pool_dtr
            mutex_lock(&dm_thin_pool_table.mutex)
            __pool_dec
              __pool_destroy
                  destroy_workqueue(pool->wq) # 销毁work queue
          __pool_table_remove
          list_del(&pool->list); 删除dm_thin_pool_table.pools
          kfree(pool)
            mutex_unlock(&dm_thin_pool_table.mutex)
free_dev(md);
```
正常destroy的过程中会将调用cancel timer后将workqueue释放。

delay work的相关流程：

```
queue_delayed_work
  queue_delayed_work_on
    __queue_delayed_work
      WARN_ON_ONCE(timer->function != delayed_work_timer_fn) # 增加定时器并指定回调函数

// 定时器到期
delayed_work_timer_fn
  __queue_work(dwork->cpu, dwork->wq, &dwork->work) # 将delay work加入workqueue
```
   
设备先设置为suspend状态：

定时器到期后pool已被释放导致UAF  
【* 影响评估及测试建议】</p><p>
【* 对外影响描述】有</p><p>

GVP openEuler/kernel
Closed

Content Risk Flag

Comments (1)

GVPopenEuler/kernelClosed

Content Risk Flag