[PATCH v2] dm: Reject table setup after queue or disk teardown

[Kirtikumar Anandrao Ramchandani]

A failed table load can leave a mapped device in a state where its
queue has already been initialized or its disk has been removed, while
md->type is still DM_TYPE_NONE. A later table load then calls
blk_mq_init_allocated_queue() on the same queue. If del_gendisk() exited
the old hardware contexts, blk_mq_exit_hctx() dereferences their cleared
flush queue pointer.

Reject setup attempts after queue initialization or disk removal. A
failed request queue initialization still leaves md->tag_set NULL and
can be retried. Set the request-based disk operations only after that
initialization succeeds, so an unsuccessful attempt cannot leave a
bio-based retry with request-based operations.

Reported-by: syzbot+5307e3bcacec2ce4c2f0@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=5307e3bcacec2ce4c2f0
Signed-off-by: Kirtikumar Anandrao Ramchandani <kirtiar15502@xxxxxxxxx>
---
Changes in v2:
- Resend as plain text after the previous mail client reformatted the diff.

 drivers/md/dm.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 1881d86..2f3f1ec 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2606,13 +2606,17 @@ int dm_setup_md_queue(struct mapped_device
*md, struct dm_table *t)

 	WARN_ON_ONCE(type == DM_TYPE_NONE);

+	/* A failed setup may have left the queue initialized or the disk dead. */
+	if (md->tag_set || test_bit(GD_DEAD, &md->disk->state))
+		return -ENODEV;
+
 	if (type == DM_TYPE_REQUEST_BASED) {
-		md->disk->fops = &dm_rq_blk_dops;
 		r = dm_mq_init_request_queue(md, t);
 		if (r) {
 			DMERR("Cannot initialize queue for request-based dm mapped device");
 			return r;
 		}
+		md->disk->fops = &dm_rq_blk_dops;
 	}

 	r = dm_calculate_queue_limits(t, &limits);

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d