dm-mirror: fix a tiny race condition

JIRA: https://issues.redhat.com/browse/RHEL-119009
Upstream Status: kernel/git/torvalds/linux.git

commit 829451b
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Tue Jun 3 18:53:17 2025 +0200

    dm-mirror: fix a tiny race condition

    There's a tiny race condition in dm-mirror. The functions queue_bio and
    write_callback grab a spinlock, add a bio to the list, drop the spinlock
    and wake up the mirrord thread that processes bios in the list.

    It may be possible that the mirrord thread processes the bio just after
    spin_unlock_irqrestore is called, before wakeup_mirrord. This spurious
    wake-up is normally harmless, however if the device mapper device is
    unloaded just after the bio was processed, it may be possible that
    wakeup_mirrord(ms) uses invalid "ms" pointer.

    Fix this bug by moving wakeup_mirrord inside the spinlock.

    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Cc: stable@vger.kernel.org

Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>

Author: bmarzins

drivers/md/dm-raid1.c

@@ -133,10 +133,9 @@ static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw)
 	spin_lock_irqsave(&ms->lock, flags);
 	should_wake = !(bl->head);
 	bio_list_add(bl, bio);
-	spin_unlock_irqrestore(&ms->lock, flags);
-
 	if (should_wake)
 		wakeup_mirrord(ms);
+	spin_unlock_irqrestore(&ms->lock, flags);
 }
 
 static void dispatch_bios(void *context, struct bio_list *bio_list)
@@ -646,9 +645,9 @@ static void write_callback(unsigned long error, void *context)
 	if (!ms->failures.head)
 		should_wake = 1;
 	bio_list_add(&ms->failures, bio);
-	spin_unlock_irqrestore(&ms->lock, flags);
 	if (should_wake)
 		wakeup_mirrord(ms);
+	spin_unlock_irqrestore(&ms->lock, flags);
 }
 
 static void do_write(struct mirror_set *ms, struct bio *bio)