[PATCH 6.6] dm: fix a crash if blk_alloc_disk fails

[PATCH 6.6] dm: fix a crash if blk_alloc_disk fails

[Bin Lan]

From: Mikulas Patocka <mpatocka@redhat.com>

[ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ]

If blk_alloc_disk fails, the variable md->disk is set to an error value.
cleanup_mapped_device will see that md->disk is non-NULL and it will
attempt to access it, causing a crash on this statement
"md->disk->private_data = NULL;".

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reported-by: Chenyuan Yang <chenyuan0y@gmail.com>
Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2
Cc: stable@vger.kernel.org
Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
---
 drivers/md/dm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 5dd0a42463a2..f45427291ea6 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor)
 	 * override accordingly.
 	 */
 	md->disk = blk_alloc_disk(md->numa_node_id);
-	if (!md->disk)
+	if (!md->disk){
+		md->disk = NULL;
 		goto bad;
+	}
 	md->queue = md->disk->queue;
 
 	init_waitqueue_head(&md->wait);
-- 
2.34.1

Re: [PATCH 6.6] dm: fix a crash if blk_alloc_disk fails

[Bin Lan]

Please ignore this patch for the return value of blk_alloc_disk() is 
non-NULL or NULL at linux-6.6.y branch.

Bin Lan

On 11/27/24 14:03, Bin Lan wrote:
> From: Mikulas Patocka <mpatocka@redhat.com>
>
> [ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ]
>
> If blk_alloc_disk fails, the variable md->disk is set to an error value.
> cleanup_mapped_device will see that md->disk is non-NULL and it will
> attempt to access it, causing a crash on this statement
> "md->disk->private_data = NULL;".
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Reported-by: Chenyuan Yang <chenyuan0y@gmail.com>
> Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2
> Cc: stable@vger.kernel.org
> Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
> Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
> ---
>   drivers/md/dm.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/dm.c b/drivers/md/dm.c
> index 5dd0a42463a2..f45427291ea6 100644
> --- a/drivers/md/dm.c
> +++ b/drivers/md/dm.c
> @@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor)
>   	 * override accordingly.
>   	 */
>   	md->disk = blk_alloc_disk(md->numa_node_id);
> -	if (!md->disk)
> +	if (!md->disk){
> +		md->disk = NULL;
>   		goto bad;
> +	}
>   	md->queue = md->disk->queue;
>   
>   	init_waitqueue_head(&md->wait);

Re: [PATCH 6.6] dm: fix a crash if blk_alloc_disk fails

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: fed13a5478680614ba97fc87e71f16e2e197912e

WARNING: Author mismatch between patch and upstream commit:
Backport author: Bin Lan <bin.lan.cn@windriver.com>
Commit author: Mikulas Patocka <mpatocka@redhat.com>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (different SHA1: d7aec2a06730)
6.6.y | Not found

Note: The patch differs from the upstream commit:
---
--- -	2024-11-27 09:24:16.233428906 -0500
+++ /tmp/tmp.Jz2z3Kr0Gz	2024-11-27 09:24:16.224663135 -0500
@@ -1,3 +1,5 @@
+[ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ]
+
 If blk_alloc_disk fails, the variable md->disk is set to an error value.
 cleanup_mapped_device will see that md->disk is non-NULL and it will
 attempt to access it, causing a crash on this statement
@@ -8,23 +10,27 @@
 Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2
 Cc: stable@vger.kernel.org
 Reviewed-by: Nitesh Shetty <nj.shetty@samsung.com>
+Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
 ---
  drivers/md/dm.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)
 
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index ff4a6b570b764..19230404d8c2b 100644
+index 5dd0a42463a2..f45427291ea6 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
-@@ -2290,8 +2290,10 @@ static struct mapped_device *alloc_dev(int minor)
+@@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor)
  	 * override accordingly.
  	 */
- 	md->disk = blk_alloc_disk(NULL, md->numa_node_id);
--	if (IS_ERR(md->disk))
-+	if (IS_ERR(md->disk)) {
+ 	md->disk = blk_alloc_disk(md->numa_node_id);
+-	if (!md->disk)
++	if (!md->disk){
 +		md->disk = NULL;
  		goto bad;
 +	}
  	md->queue = md->disk->queue;
  
  	init_waitqueue_head(&md->wait);
+-- 
+2.34.1
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y        |  Success    |  Success   |