[Devel] [PATCH hci-8.1 1/2] dm-zero-rq: fix a NULL dereference mapping a flush request

[no-reply at sashiko.virtuozzo.com]

> From: Denis V. Lunev <den at openvz.org>
> 
> zero_clone_and_map_rq() reads the operation from rq->bio. The flush
> request the block layer issues for a preflush carries no bio, so the
> target oopses in the kblockd worker:
> 
>   BUG: kernel NULL pointer dereference, address: 0000000000000010
>   RIP: 0010:zero_clone_and_map_rq+0x12/0x70 [dm_zero_rq]
>    map_request+0x57/0x230 [dm_mod]
>    dm_mq_queue_rq+0xe0/0x240 [dm_mod]
> 
> zero-rq advertises no write cache, but a flush reaches it anyway after
> a table swap. ploop releases a device by reloading it to the error
> target, which keeps the write cache on, and later to zero-rq while the
> file system on top is still mounted. A flush queued against the
> previous table waits out the suspend and is dispatched to zero-rq on
> resume. A sync during "vzctl release-disks" is enough to hit it.
> 
> Take the operation from the request. The flush is now killed like any
> other request zero-rq does not handle.
> 
> Fixes: caf9c61aeb93 ("dm-zero-req: Introduce zero request based target")
> https://virtuozzo.atlassian.net/browse/VSTOR-152097
> Feature: cbt: changed block tracking (for backup)
> Signed-off-by: Denis V. Lunev <den at openvz.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261028123130.2828357-1-den@openvz.org?part=1