From: Mikulas Patocka mpatocka@redhat.com
[ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ]
If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement "md->disk->private_data = NULL;".
Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reported-by: Chenyuan Yang chenyuan0y@gmail.com Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2 Cc: stable@vger.kernel.org Reviewed-by: Nitesh Shetty nj.shetty@samsung.com Signed-off-by: Bin Lan bin.lan.cn@windriver.com --- drivers/md/dm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 5dd0a42463a2..f45427291ea6 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor) * override accordingly. */ md->disk = blk_alloc_disk(md->numa_node_id); - if (!md->disk) + if (!md->disk){ + md->disk = NULL; goto bad; + } md->queue = md->disk->queue;
init_waitqueue_head(&md->wait);
Please ignore this patch for the return value of blk_alloc_disk() is non-NULL or NULL at linux-6.6.y branch.
Bin Lan
On 11/27/24 14:03, Bin Lan wrote:
From: Mikulas Patocka mpatocka@redhat.com
[ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ]
If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement "md->disk->private_data = NULL;".
Signed-off-by: Mikulas Patocka mpatocka@redhat.com Reported-by: Chenyuan Yang chenyuan0y@gmail.com Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2 Cc: stable@vger.kernel.org Reviewed-by: Nitesh Shetty nj.shetty@samsung.com Signed-off-by: Bin Lan bin.lan.cn@windriver.com
drivers/md/dm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 5dd0a42463a2..f45427291ea6 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor) * override accordingly. */ md->disk = blk_alloc_disk(md->numa_node_id);
- if (!md->disk)
- if (!md->disk){
md->disk = NULL;- } md->queue = md->disk->queue;
init_waitqueue_head(&md->wait);
[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: fed13a5478680614ba97fc87e71f16e2e197912e
WARNING: Author mismatch between patch and upstream commit: Backport author: Bin Lan bin.lan.cn@windriver.com Commit author: Mikulas Patocka mpatocka@redhat.com
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.11.y | Present (different SHA1: d7aec2a06730) 6.6.y | Not found
Note: The patch differs from the upstream commit: --- --- - 2024-11-27 09:24:16.233428906 -0500 +++ /tmp/tmp.Jz2z3Kr0Gz 2024-11-27 09:24:16.224663135 -0500 @@ -1,3 +1,5 @@ +[ Upstream commit fed13a5478680614ba97fc87e71f16e2e197912e ] + If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement @@ -8,23 +10,27 @@ Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2 Cc: stable@vger.kernel.org Reviewed-by: Nitesh Shetty nj.shetty@samsung.com +Signed-off-by: Bin Lan bin.lan.cn@windriver.com --- drivers/md/dm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index ff4a6b570b764..19230404d8c2b 100644 +index 5dd0a42463a2..f45427291ea6 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c -@@ -2290,8 +2290,10 @@ static struct mapped_device *alloc_dev(int minor) +@@ -2077,8 +2077,10 @@ static struct mapped_device *alloc_dev(int minor) * override accordingly. */ - md->disk = blk_alloc_disk(NULL, md->numa_node_id); -- if (IS_ERR(md->disk)) -+ if (IS_ERR(md->disk)) { + md->disk = blk_alloc_disk(md->numa_node_id); +- if (!md->disk) ++ if (!md->disk){ + md->disk = NULL; goto bad; + } md->queue = md->disk->queue;
init_waitqueue_head(&md->wait); +-- +2.34.1 + ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-6.6.y | Success | Success |
linux-stable-mirror@lists.linaro.org
-
Bin Lan -
Bin Lan
-
Sasha Levin