[BUG] KASAN: null-ptr-deref Read in dm_kcopyd_client_destroy

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/169-kasan-null-ptr-deref-read-in-dm-kcopyd-client-destroy/

  workqueue: Failed to create a rescuer kthread for wq "kcopyd": -EINTR
  BUG: KASAN: null-ptr-deref in dm_kcopyd_client_destroy+0x9e/0x480
drivers/md/dm-kcopyd.c:980
  Read of size 4 at addr 00000000000000a4 by task syz.2.409/14796
  Call Trace:
   dm_kcopyd_client_destroy+0x9e/0x480 drivers/md/dm-kcopyd.c:980
   __destroy+0x172/0x2f0 drivers/md/dm-cache-target.c:1969
   cache_create drivers/md/dm-cache-target.c:2600 [inline]
   cache_ctr+0x1614/0x2af0 drivers/md/dm-cache-target.c:2645
   dm_table_add_target+0x5c9/0xce0 drivers/md/dm-table.c:749
   populate_table drivers/md/dm-ioctl.c:1509 [inline]
   table_load+0x2f9/0x810 drivers/md/dm-ioctl.c:1551
   ctl_ioctl drivers/md/dm-ioctl.c:2115 [inline]

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,