[Devel] [PATCH hci-8.1 v2] dm table: don't inherit live table's type for request-based tables

[Alexander Ivanov <alexander.ivanov@virtuozzo.com>]

A request-based table without devices inherits the live table's type
in dm_table_determine_type(). Since commit 6936c12cf809 ("dm table: fix
'all_blk_mq' inconsistency when an empty table is loaded") this
includes bio-based types, although the inheritance was meant to pick a
variant of the request-based type, and only one is left now. So a
request-based table loaded over a bio-based device becomes bio-based,
which its target cannot serve.

dm-qcow2 and dm-ploop open their images by fd and never call
dm_get_device(). Loaded over a bio-based device they have no ->map, and
the first bio calls a NULL ->map from __map_bio():

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  RIP: 0010:0x0
   __map_bio+0x197/0x1c0 [dm_mod]
   dm_split_and_process_bio+0x1ad/0x740 [dm_mod]

A multipath table with no paths and the default rq queue_mode keeps
m->queue_mode request-based while the table is bio-based. Its
per_io_data_size is sized for a request, so the first bio overruns its
per-bio data in multipath_map_bio():

  BUG: KASAN: slab-out-of-bounds in multipath_map_bio+0x376/0x380
   __map_bio+0x433/0x4f0
   dm_submit_bio+0x48a/0x1620

Removing the device then kicks the requeue list of a bio-based queue
from multipath_presuspend() and corrupts memory:

  WARNING: CPU: 4 PID: 345054 at kernel/workqueue.c:2498 __queue_delayed_work+0xf1/0x130
   kblockd_mod_delayed_work_on+0x1b/0x30
   dm_table_presuspend_targets+0x3d/0x60 [dm_mod]
   __dm_destroy+0x19f/0x1d0 [dm_mod]
  Oops: general protection fault, probably for non-canonical address 0xd352851d5c47d388

Drop the inheritance. table_load() then rejects such a table with
"can't change device type", as it does for request-based tables with
devices.

https://virtuozzo.atlassian.net/browse/VSTOR-150573
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-table.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 954bbc338bce..e306eb51b592 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -983,16 +983,8 @@ static int dm_table_determine_type(struct dm_table *t)
 		return -EINVAL;
 	}
 
-	if (list_empty(devices)) {
-		int srcu_idx;
-		struct dm_table *live_table = dm_get_live_table(t->md, &srcu_idx);
-
-		/* inherit live table's type */
-		if (live_table)
-			t->type = live_table->type;
-		dm_put_live_table(t->md, srcu_idx);
+	if (list_empty(devices))
 		return 0;
-	}
 
 	ti = dm_table_get_target(t, 0);
 	if (ti->max_io_len) {
-- 
2.53.0

_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel