A request-based table without devices inherits the live table's type
in dm_table_determine_type(). Since commit 6936c12cf809 ("dm table: fix
'all_blk_mq' inconsistency when an empty table is loaded") this
includes bio-based types, although the inheritance was meant to pick a
variant of the request-based type, and only one is left now. So a
request-based table loaded over a bio-based device becomes bio-based,
which its target cannot handle.
A multipath table with no paths and the default rq queue_mode keeps
m->queue_mode request-based while the table is bio-based. Its
per_io_data_size is sized for a request, so the first bio overruns its
per-bio data in multipath_map_bio():
BUG: KASAN: slab-out-of-bounds in multipath_map_bio+0x376/0x380
__map_bio+0x433/0x4f0
dm_submit_bio+0x48a/0x1620
Removing the device then kicks the requeue work of a bio-based queue,
which was never initialized, from multipath_presuspend():
WARNING: kernel/workqueue.c:2606 at __queue_delayed_work+0x29c/0x340
mod_delayed_work_on+0xee/0x100
kblockd_mod_delayed_work_on+0x16/0x20
dm_table_presuspend_targets+0xdf/0x160
__dm_destroy+0x41b/0x530
Drop the inheritance. table_load() then rejects such a table with
"can't change device type", as it does for request-based tables with
devices.
Fixes: 6936c12cf809 ("dm table: fix 'all_blk_mq' inconsistency when an empty
table is loaded")
Signed-off-by: Alexander Ivanov <[email protected]>
---
drivers/md/dm-table.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index a483f49dd4ce..c5e55b4a527c 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -967,16 +967,8 @@ static int dm_table_determine_type(struct dm_table *t)
return -EINVAL;
}
- if (list_empty(devices)) {
- int srcu_idx;
- struct dm_table *live_table = dm_get_live_table(t->md,
&srcu_idx);
-
- /* inherit live table's type */
- if (live_table)
- t->type = live_table->type;
- dm_put_live_table(t->md, srcu_idx);
+ if (list_empty(devices))
return 0;
- }
ti = dm_table_get_immutable_target(t);
if (!ti) {
--
2.53.0
