[Devel] [PATCH hci-8.1 v2] dm table: don't inherit live table's type for request-based tables

[Andrey Zhadchenko]

Reviewed-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>

On 10/20/26 09:52, Alexander Ivanov wrote:
> A request-based table without devices inherits the live table's type
> in dm_table_determine_type(). Since commit 6936c12cf809 ("dm table: fix
> 'all_blk_mq' inconsistency when an empty table is loaded") this
> includes bio-based types, although the inheritance was meant to pick a
> variant of the request-based type, and only one is left now. So a
> request-based table loaded over a bio-based device becomes bio-based,
> which its target cannot serve.
> 
> dm-qcow2 and dm-ploop open their images by fd and never call
> dm_get_device(). Loaded over a bio-based device they have no ->map, and
> the first bio calls a NULL ->map from __map_bio():
> 
>    BUG: kernel NULL pointer dereference, address: 0000000000000000
>    RIP: 0010:0x0
>     __map_bio+0x197/0x1c0 [dm_mod]
>     dm_split_and_process_bio+0x1ad/0x740 [dm_mod]
> 
> A multipath table with no paths and the default rq queue_mode keeps
> m->queue_mode request-based while the table is bio-based. Its
> per_io_data_size is sized for a request, so the first bio overruns its
> per-bio data in multipath_map_bio():
> 
>    BUG: KASAN: slab-out-of-bounds in multipath_map_bio+0x376/0x380
>     __map_bio+0x433/0x4f0
>     dm_submit_bio+0x48a/0x1620
> 
> Removing the device then kicks the requeue list of a bio-based queue
> from multipath_presuspend() and corrupts memory:
> 
>    WARNING: CPU: 4 PID: 345054 at kernel/workqueue.c:2498 __queue_delayed_work+0xf1/0x130
>     kblockd_mod_delayed_work_on+0x1b/0x30
>     dm_table_presuspend_targets+0x3d/0x60 [dm_mod]
>     __dm_destroy+0x19f/0x1d0 [dm_mod]
>    Oops: general protection fault, probably for non-canonical address 0xd352851d5c47d388
> 
> Drop the inheritance. table_load() then rejects such a table with
> "can't change device type", as it does for request-based tables with
> devices.
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-150573
> Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
> ---
>   drivers/md/dm-table.c | 10 +---------
>   1 file changed, 1 insertion(+), 9 deletions(-)
> 
> diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
> index 954bbc338bce..e306eb51b592 100644
> --- a/drivers/md/dm-table.c
> +++ b/drivers/md/dm-table.c
> @@ -983,16 +983,8 @@ static int dm_table_determine_type(struct dm_table *t)
>   		return -EINVAL;
>   	}
>   
> -	if (list_empty(devices)) {
> -		int srcu_idx;
> -		struct dm_table *live_table = dm_get_live_table(t->md, &srcu_idx);
> -
> -		/* inherit live table's type */
> -		if (live_table)
> -			t->type = live_table->type;
> -		dm_put_live_table(t->md, srcu_idx);
> +	if (list_empty(devices))
>   		return 0;
> -	}
>   
>   	ti = dm_table_get_target(t, 0);
>   	if (ti->max_io_len) {