dm integrity: Fix UAF in dm_integrity_dtr()

Bugzilla: https://bugzilla.redhat.com/2162536
Upstream Status: kernel/git/torvalds/linux.git

commit f50cb2c
Author: Luo Meng <luomeng12@huawei.com>
Date:   Tue Nov 29 10:48:50 2022 +0800

    dm integrity: Fix UAF in dm_integrity_dtr()

    Dm_integrity also has the same UAF problem when dm_resume()
    and dm_destroy() are concurrent.

    Therefore, cancelling timer again in dm_integrity_dtr().

    Cc: stable@vger.kernel.org
    Fixes: 7eada90 ("dm: add integrity target")
    Signed-off-by: Luo Meng <luomeng12@huawei.com>
    Signed-off-by: Mike Snitzer <snitzer@kernel.org>

Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>

Author: bmarzins

drivers/md/dm-integrity.c

@@ -4555,6 +4555,8 @@ static void dm_integrity_dtr(struct dm_target *ti)
 	BUG_ON(!RB_EMPTY_ROOT(&ic->in_progress));
 	BUG_ON(!list_empty(&ic->wait_list));
 
+	if (ic->mode == 'B')
+		cancel_delayed_work_sync(&ic->bitmap_flush_work);
 	if (ic->metadata_wq)
 		destroy_workqueue(ic->metadata_wq);
 	if (ic->wait_wq)