Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Mike Snitzer 3990e5b2be dm: fix dm-raid crash if md_handle_request() splits bio ... [ Upstream commit 9dd1cd3220 ] Commit ca522482e3 ("dm: pass NULL bdev to bio_alloc_clone") introduced the optimization to _not_ perform bio_associate_blkg()'s relatively costly work when DM core clones its bio. But in doing so it exposed the possibility for DM's cloned bio to alter DM target behavior (e.g. crash) if a target were to issue IO without first calling bio_set_dev(). The DM raid target can trigger an MD crash due to its need to split the DM bio that is passed to md_handle_request(). The split will recurse to submit_bio_noacct() using a bio with an uninitialized ->bi_blkg. This NULL bio->bi_blkg causes blk_throtl_bio() to dereference a NULL blkg_to_tg(bio->bi_blkg). Fix this in DM core by adding a new 'needs_bio_set_dev' target flag that will make alloc_tio() call bio_set_dev() on behalf of the target. dm-raid is the only target that requires this flag. bio_set_dev() initializes the DM cloned bio's ->bi_blkg, using bio_associate_blkg, before passing the bio to md_handle_request(). Long-term fix would be to audit and refactor MD code to rely on DM to split its bio, using dm_accept_partial_bio(), but there are MD raid personalities (e.g. raid1 and raid10) whose implementation are tightly coupled to handling the bio splitting inline. Fixes: ca522482e3 ("dm: pass NULL bdev to bio_alloc_clone") Cc: stable@vger.kernel.org Signed-off-by: Mike Snitzer <snitzer@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		History 2022-08-17 15:16:14 +02:00
..
asm-generic	tools: Fixed MIPS builds due to struct flock re-definition	2022-07-20 12:55:33 +02:00
drm	drm/fourcc: fix integer type usage in uapi header	2022-06-29 14:50:51 -04:00
linux	dm: fix dm-raid crash if md_handle_request() splits bio	2022-08-17 15:16:14 +02:00
misc	habanalabs: add support for notification via eventfd	2022-05-22 21:01:20 +02:00
mtd	mtd: add OTP (one-time-programmable) erase ioctl	2021-03-28 19:24:54 +02:00
rdma	RDMA: Split kernel-only global device caps from uverbs device caps	2022-04-06 15:02:13 -03:00
scsi	scsi: mpi3mr: Add support for NVMe passthrough	2022-05-02 17:02:42 -04:00
sound	ASoC: SOF: ipc: introduce cont_update_posn in sof_ipc_stream_params struct	2022-05-10 14:01:54 +01:00
video	License cleanup: add SPDX license identifier to uapi header files with a license	2017-11-02 11:20:11 +01:00
xen	Improve docs for IOCTL_GNTDEV_MAP_GRANT_REF	2022-02-03 08:23:32 +01:00
Kbuild	kbuild: re-implement Makefile.headersinst without recursion	2019-06-15 19:57:02 +09:00