[BUG] dm-integrity: mode R resume NULL deref when DIRTY_BITMAP is set

[Yu Junzhe <junzheyu1@gmail.com>]

Hello,

I am reporting a null-pointer dereference in dm-integrity resume: recovery
mode R skips journal allocation, but dm_integrity_resume() still issues
journal I/O when the on-disk superblock has SB_FLAG_DIRTY_BITMAP.

Summary
=======

create_journal() runs only when mode != 'R', so ic->journal stays NULL.
Resume treats DIRTY_BITMAP as "journal pages hold a bitmap" and calls
rw_journal_sectors() before any journal/mode check:

  if (ic->sb->flags & cpu_to_le32(SB_FLAG_DIRTY_BITMAP)) {
      rw_journal_sectors(ic, REQ_OP_READ, ...);  /* uses ic->journal[] */

rw_journal_sectors() then passes that NULL page list into dm_io():

  io_req.mem.type = DM_IO_PAGE_LIST;
  io_req.mem.ptr.pl = &ic->journal[pl_index];  /* NULL in mode R */

list_get_page() does *p = pl->page with pl == NULL (KASAN range [0x8-0xf]).

DIRTY_BITMAP is set while bitmap mode (B) is active and is cleared on a
clean postsuspend. It remains on disk after an unclean stop of mode B
(crash / power loss). Reloading that device in recovery mode R is a
documented recovery path and hits this bug.

Affected
========

- Confirmed on Linux 6.6.144 (da47cbc254661aa66d61ef061485a7080305c4be),
  KASAN guest
- Still present on torvalds/linux master as of 2026-08-17: resume still
  calls rw_journal_sectors() under DIRTY_BITMAP with no journal / mode-R
  guard
- Files: drivers/md/dm-integrity.c
- Config: CONFIG_DM=y, CONFIG_DM_INTEGRITY=y (KASAN for the report)

Crash excerpt (from minimized PoC)
==================================

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 234 Comm: repro Not tainted 6.6.144 #15
RIP: 0010:list_get_page+0x7e/0x150
Call Trace:
 <TASK>
  dispatch_io
  sync_io
  dm_io
  rw_journal_sectors
  dm_integrity_resume
  dm_table_resume_targets
  __dm_resume
  dm_resume
  dev_suspend
  ctl_ioctl
  dm_ctl_ioctl
  __x64_sys_ioctl
 </TASK>
Kernel panic - not syncing: Fatal exception

Full oops and a self-contained Docker/QEMU reproducer (poc.c + KASAN
guest) are available on request.

I am happy to test patches or send the reproducer package.

Thanks,
Yu Junzhe
FuzzAnything <fuzzanything@gmail.com>