[Devel] [PATCH hci-8.1 1/2] dm-zero-rq: fix a NULL dereference mapping a flush request

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

zero_clone_and_map_rq() reads the operation from rq->bio. The flush
request the block layer issues for a preflush carries no bio, so the
target oopses in the kblockd worker:

  BUG: kernel NULL pointer dereference, address: 0000000000000010
  RIP: 0010:zero_clone_and_map_rq+0x12/0x70 [dm_zero_rq]
   map_request+0x57/0x230 [dm_mod]
   dm_mq_queue_rq+0xe0/0x240 [dm_mod]

zero-rq advertises no write cache, but a flush reaches it anyway after
a table swap. ploop releases a device by reloading it to the error
target, which keeps the write cache on, and later to zero-rq while the
file system on top is still mounted. A flush queued against the
previous table waits out the suspend and is dispatched to zero-rq on
resume. A sync during "vzctl release-disks" is enough to hit it.

Take the operation from the request. The flush is now killed like any
other request zero-rq does not handle.

Fixes: caf9c61aeb93 ("dm-zero-req: Introduce zero request based target")
https://virtuozzo.atlassian.net/browse/VSTOR-152097
Feature: cbt: changed block tracking (for backup)
Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/md/dm-zero-rq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-zero-rq.c b/drivers/md/dm-zero-rq.c
index 9e44de15dcd6..4f09266ff5ed 100644
--- a/drivers/md/dm-zero-rq.c
+++ b/drivers/md/dm-zero-rq.c
@@ -38,7 +38,7 @@ static int zero_clone_and_map_rq(struct dm_target *ti, struct request *rq,
 {
 	struct bio *bio = rq->bio;
 
-	switch (bio_op(bio)) {
+	switch (req_op(rq)) {
 	case REQ_OP_READ:
 		while (bio) {
 			zero_fill_bio(bio);
-- 
2.53.0