From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Mikulas Patocka <mpatocka@redhat.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 7.2 02/10] dm-integrity: fix NULL pointer dereference when the R flag is used
Date: Sat, 17 Oct 2026 17:54:31 +0200 [thread overview]
Message-ID: <20261017155059.792072896@linuxfoundation.org> (raw)
In-Reply-To: <20261017155059.698368299@linuxfoundation.org>
7.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
[ Upstream commit 7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84 ]
If the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the
user activates the device in the 'R' mode, a crash in dm_integrity_resume
happens because the function attempts to read the journal containing the
bitmap.
This patch makes dm-integrity skip any writes to the device in
dm_integrity_resume if the device is activated in the 'R' mode.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 468dfca38b1a ("dm integrity: add a bitmap mode")
Cc: stable@vger.kernel.org
Stable-dep-of: fc79aeb86a2c ("dm-integrity: validate the superblock on resume")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-integrity.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index 4bda7b5dba1a6..cded0607b39c0 100644
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -3874,6 +3874,10 @@ static void dm_integrity_resume(struct dm_target *ti)
r = sync_rw_sb(ic, REQ_OP_READ);
if (r)
dm_integrity_io_error(ic, "reading superblock", r);
+
+ if (ic->mode == 'R')
+ goto skip_writes;
+
if ((ic->sb->flags & flags) != flags) {
ic->sb->flags |= flags;
r = sync_rw_sb(ic, REQ_OP_WRITE | REQ_FUA);
@@ -3983,6 +3987,7 @@ static void dm_integrity_resume(struct dm_target *ti)
}
}
+skip_writes:
ic->reboot_notifier.notifier_call = dm_integrity_reboot;
ic->reboot_notifier.next = NULL;
ic->reboot_notifier.priority = INT_MAX - 1; /* be notified after md and before hardware drivers */
--
2.53.0
next prev parent reply other threads:[~2026-10-17 15:54 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-17 15:54 [PATCH 7.2 00/10] 7.2.12-rc1 review Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 01/10] nfsd: fix all-zero stateid in CB_OFFLOAD for async COPY Greg Kroah-Hartman
2026-10-17 15:54 ` Greg Kroah-Hartman [this message]
2026-10-17 15:54 ` [PATCH 7.2 03/10] dm-integrity: validate the superblock on resume Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 04/10] sched_ext: Fix CPU hotplug hang when a dying CPUs tasks sit in the BPF scheduler Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 05/10] nullfs: refuse file locks Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 06/10] readdir: take no inode lock on an immutable directory Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 07/10] net: mana: refactor mana_get_strings() and mana_get_sset_count() to use switch Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 08/10] net: mana: reserve RX buffer headroom to fix forwarding performance Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 09/10] wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" Greg Kroah-Hartman
2026-10-17 15:54 ` [PATCH 7.2 10/10] ASoC: cs35l56: Add DAI for SDCA OT25 stream Greg Kroah-Hartman
2026-10-17 16:47 ` [PATCH 7.2 00/10] 7.2.12-rc1 review Ronald Warsow
2026-10-17 17:19 ` Brett A C Sheffield
2026-10-17 21:25 ` Peter Schneider
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261017155059.792072896@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=mpatocka@redhat.com \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.