Mike Snitzer 3990e5b2be dm: fix dm-raid crash if md_handle_request() splits bio
[ Upstream commit 9dd1cd3220eca534f2d47afad7ce85f4c40118d8 ]

Commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
introduced the optimization to _not_ perform bio_associate_blkg()'s
relatively costly work when DM core clones its bio. But in doing so it
exposed the possibility for DM's cloned bio to alter DM target
behavior (e.g. crash) if a target were to issue IO without first
calling bio_set_dev().

The DM raid target can trigger an MD crash due to its need to split
the DM bio that is passed to md_handle_request(). The split will
recurse to submit_bio_noacct() using a bio with an uninitialized
->bi_blkg. This NULL bio->bi_blkg causes blk_throtl_bio() to
dereference a NULL blkg_to_tg(bio->bi_blkg).

Fix this in DM core by adding a new 'needs_bio_set_dev' target flag that
will make alloc_tio() call bio_set_dev() on behalf of the target.
dm-raid is the only target that requires this flag. bio_set_dev()
initializes the DM cloned bio's ->bi_blkg, using bio_associate_blkg,
before passing the bio to md_handle_request().

Long-term fix would be to audit and refactor MD code to rely on DM to
split its bio, using dm_accept_partial_bio(), but there are MD raid
personalities (e.g. raid1 and raid10) whose implementation are tightly
coupled to handling the bio splitting inline.

Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-17 15:16:14 +02:00
..
2022-06-03 10:25:56 -07:00
2022-05-05 17:31:35 -04:00
2022-05-05 17:31:35 -04:00
2022-05-27 15:49:30 -07:00
2022-05-27 15:49:30 -07:00
2022-06-08 14:04:14 -04:00
2022-06-08 14:04:14 -04:00
2022-06-08 14:04:14 -04:00
2022-05-22 23:07:21 -07:00
2022-03-08 15:16:54 -08:00
2022-05-22 23:07:21 -07:00
2022-03-08 15:16:54 -08:00
2022-07-22 12:41:14 -07:00
2022-08-17 15:13:55 +02:00
2022-03-08 15:16:54 -08:00