[PATCH] dm-cache: fix NULL pointer dereference on open failure

[PATCH] dm-cache: fix NULL pointer dereference on open failure

[Mikulas Patocka]

When __begin_transaction_flags in metadata_open fails,
dm_cache_metadata_close is called. dm_cache_metadata_close attempts to
execute list_del(&cmd->list);, but the "cmd" object is not on any list
yet, thus it crashes with NULL pointer dereference.

Fix this by initializing cmd->list after cmd is allocated.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Fixes: c6b4fcbad044 ("dm: add cache target")

---
 drivers/md/dm-cache-metadata.c |    1 +
 1 file changed, 1 insertion(+)

Index: linux-2.6/drivers/md/dm-cache-metadata.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-cache-metadata.c
+++ linux-2.6/drivers/md/dm-cache-metadata.c
@@ -766,6 +766,7 @@ static struct dm_cache_metadata *metadat
 		return ERR_PTR(-ENOMEM);
 	}
 
+	INIT_LIST_HEAD(&cmd->list);
 	cmd->version = metadata_version;
 	refcount_set(&cmd->ref_count, 1);
 	init_rwsem(&cmd->root_lock);

Re: [PATCH] dm-cache: fix NULL pointer dereference on open failure

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] dm-cache: Fixes trailer cites c6b4fcbad044 instead of
  9b1cc9f251af
--

commit 9e9ca29bfbdfdcf14064f5312fa72be5b8ba53a8
Author: Mikulas Patocka <mpatocka@redhat.com>

> dm-cache: fix NULL pointer dereference on open failure
>
> When __begin_transaction_flags in metadata_open fails,
> dm_cache_metadata_close is called. dm_cache_metadata_close attempts to
> execute list_del(&cmd->list);, but the "cmd" object is not on any list
> yet, thus it crashes with NULL pointer dereference.
>
> Fix this by initializing cmd->list after cmd is allocated.
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Fixes: c6b4fcbad044 ("dm: add cache target")

[Severity: Low]
Should the Fixes: tag reference 9b1cc9f251af ("dm cache: share
cache-metadata object across inactive and active DM tables") instead?

In c6b4fcbad044 ("dm: add cache target"), struct dm_cache_metadata did not
have a list member and dm_cache_metadata_close() did not call list_del().
Commit 9b1cc9f251af ("dm cache: share cache-metadata object across
inactive and active DM tables") added cmd->list, deferred list_add() to
lookup_or_open() after metadata_open() succeeds, and added
list_del(&cmd->list) to dm_cache_metadata_close().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/05b79ec2-42f7-ffe3-20e6-1dc499e60cf5@redhat.com?part=1

Re: [PATCH] dm-cache: fix NULL pointer dereference on open failure

[Ming Hung Tsai]

On Sat, Nov 7, 2026 at 2:55 AM Mikulas Patocka <mpatocka@redhat.com> wrote:
>
> When __begin_transaction_flags in metadata_open fails,
> dm_cache_metadata_close is called. dm_cache_metadata_close attempts to
> execute list_del(&cmd->list);, but the "cmd" object is not on any list
> yet, thus it crashes with NULL pointer dereference.
>
> Fix this by initializing cmd->list after cmd is allocated.
>
> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
> Assisted-by: Claude:claude-opus-5
> Cc: stable@vger.kernel.org
> Fixes: c6b4fcbad044 ("dm: add cache target")
>
> ---
>  drivers/md/dm-cache-metadata.c |    1 +
>  1 file changed, 1 insertion(+)
>
> Index: linux-2.6/drivers/md/dm-cache-metadata.c
> ===================================================================
> --- linux-2.6.orig/drivers/md/dm-cache-metadata.c
> +++ linux-2.6/drivers/md/dm-cache-metadata.c
> @@ -766,6 +766,7 @@ static struct dm_cache_metadata *metadat
>                 return ERR_PTR(-ENOMEM);
>         }
>
> +       INIT_LIST_HEAD(&cmd->list);
>         cmd->version = metadata_version;
>         refcount_set(&cmd->ref_count, 1);
>         init_rwsem(&cmd->root_lock);
>
>

This bug triggers when dm-cache fails to update the superblock flags
while opening the metadata. A dm-flakey target can simulate the write
failure:

1. Create a fresh dm-cache device.
2. Remove the cache target.
3. Replace the metadata device with a dm-flakey target that drops writes.
4. Reopen the cache device.

Kernel logs:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1]I
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 93 Comm: dmsetup Not tainted 6.19.0-rc7 #100
PREEMPT(voluntary)
RIP: 0010:dm_cache_metadata_close+0xaf/0x260
Call Trace:
 dm_cache_metadata_open+0xfb2/0x14e0
 ? __pfx_dm_cache_metadata_open+0x10/0x10
 ? smq_create+0x1d/0x30
 ? dm_cache_policy_create+0x108/0x2c0
 cache_ctr+0x1505/0x3710
 ...

This bug happens only from the dm_cache_metadata_close() call inside
metadata_open(). The other two callers get a linked cmd->list, so they
are safe. A different data_block_size alone cannot trigger the bug
either. __open_metadata() checks it before all persistent data objects
exist, so metadata_open() frees cmd with kfree() instead of
dm_cache_metadata_close().

Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>