[Devel] [PATCH hci-8.1 0/2] dm-zero-rq: fix a crash on a flush after ploop release

[Andrey Zhadchenko]

Reviewed-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>

On 10/28/26 13:31, Denis V. Lunev wrote:
> ploop releases a device by reloading it to the error target, and
> ploop_dmreload_zero() (VSTOR-146886) later reloads it to zero-rq while
> the file system on top is still mounted. A request queued against the previous table waits out
> the suspend and is dispatched to zero-rq on resume.
> 
> For a flush this is a host panic: the flush request has no bio and
> zero_clone_and_map_rq() reads the operation from rq->bio. QA hit it in
> the vzctl release-disks test on hci-8.1 (VSTOR-152097): sgdisk run by
> "vzctl release-disks" called sync() just before the reload. The vmcore
> shows the queue's own flush_rq (REQ_OP_FLUSH, bio NULL, end_io
> flush_end_io) in zero-rq, and the original empty PREFLUSH bio from
> ext4_sync_fs() still waiting on the flush queue.
> 
> Patch 1 fixes the crash: the operation is taken from the request, and a
> flush is killed like any other request zero-rq does not handle. Patch 2
> completes flushes, discards and write zeroes instead of failing them,
> which is what the zero-rq reload is there for. It is split out because
> it changes what the target returns, not only whether it crashes.
> 
> The error and multipath request-based targets do not look at rq->bio,
> so mainline is not affected; dm-zero-rq is ours.
> 
> Tested on 6.12.0-211.52.1.22.10.vz10 with the module built out of tree,
> by suspending a released device, starting a sync or a blkdiscard on it,
> then running ploop_dmreload_zero():
> - stock: the node panics with the oops QA got, every time;
> - patch 1: no panic, the sync and the discard fail with EIO;
> - patches 1+2: both complete, nothing in the log;
> - the ploop release tests, ploop and qcow2 formats, pass. The new
>    tests for ploop_dmreload_zero() and the reproducer above go to ploop
>    separately.
> 
> Denis V. Lunev (2):
>    dm-zero-rq: fix a NULL dereference mapping a flush request
>    dm-zero-rq: drop flushes, discards and write zeroes instead of failing
>      them
> 
>   drivers/md/dm-zero-rq.c | 12 +++++-------
>   1 file changed, 5 insertions(+), 7 deletions(-)
> 
> 
> base-commit: b499efa17aa9fb8f20512d1831d1cb61b22e60d3