From 0259eef8a062504916c102ad08088bf58b04f1ee Mon Sep 17 00:00:00 2001 From: Vova Sharaienko Date: Tue, 7 Jul 2026 02:40:28 +0000 Subject: [PATCH] ANDROID: dm-bow: Fix Race Condition in dm_bow_tablestatus() Acquire bc->ranges_lock earlier in the function to protect trimmed_list and ranges traversal against concurrent modifications. Bug: 499160651 Change-Id: I06f034d7e9ddc024930b33216f911f7a321cafe0 Signed-off-by: Vova Sharaienko --- drivers/md/dm-bow.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/md/dm-bow.c b/drivers/md/dm-bow.c index 8a7f71bf71a0..009a896550d9 100644 --- a/drivers/md/dm-bow.c +++ b/drivers/md/dm-bow.c @@ -1202,28 +1202,28 @@ static void dm_bow_tablestatus(struct dm_target *ti, char *result, return; result[0] = 0; + mutex_lock(&bc->ranges_lock); list_for_each_entry(br, &bc->trimmed_list, trimmed_list) if (br->type == TRIMMED) { ++trimmed_list_length; } else { scnprintf(result, end - result, "ERROR: non-trimmed entry in trimmed_list"); - return; + goto unlock; } if (!rb_first(&bc->ranges)) { scnprintf(result, end - result, "ERROR: Empty ranges"); - return; + goto unlock; } if (container_of(rb_first(&bc->ranges), struct bow_range, node) ->sector) { scnprintf(result, end - result, "ERROR: First range does not start at sector 0"); - return; + goto unlock; } - mutex_lock(&bc->ranges_lock); for (i = rb_first(&bc->ranges); i; i = rb_next(i)) { struct bow_range *br = container_of(i, struct bow_range, node);