The value of cache->copier is -EINTR when failed to create a rescuer
kthread for wq kcopyd, in cache_create(), the code jumps directly to
__destroy(cache), it merely performs a simple check to see whether copier
is NULL, potentially hitting:
BUG: KASAN: null-ptr-deref in dm_kcopyd_client_destroy+0xae/0x480
drivers/md/dm-kcopyd.c:980
Read of size 4 at addr 0000000000000174 by task syz.2.19/6560
Call Trace:
dm_kcopyd_client_destroy+0xae/0x480 drivers/md/dm-kcopyd.c:980
__destroy+0x172/0x2f0 drivers/md/dm-cache-target.c:1973
cache_create drivers/md/dm-cache-target.c:2604 [inline]
cache_ctr+0x1674/0x2bf0 drivers/md/dm-cache-target.c:2649
dm_table_add_target+0x58d/0xc70 drivers/md/dm-table.c:749
populate_table drivers/md/dm-ioctl.c:1602 [inline]
table_load+0x325/0x8a0 drivers/md/dm-ioctl.c:1645
ctl_ioctl drivers/md/dm-ioctl.c:2221 [inline]
Set copier to NULL to avoid destroying a invalid kcopy client.
Fixes: c6b4fcbad044 ("dm: add cache target")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=a2626a25eb2595e3ec3c
Signed-off-by: Edward Adam Davis <[email protected]>
---
drivers/md/dm-cache-target.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
index 1a5072425c4a..b562bf59124c 100644
--- a/drivers/md/dm-cache-target.c
+++ b/drivers/md/dm-cache-target.c
@@ -2544,6 +2544,7 @@ static int cache_create(struct cache_args *ca, struct
cache **result)
if (IS_ERR(cache->copier)) {
*error = "could not create kcopyd client";
r = PTR_ERR(cache->copier);
+ cache->copier = NULL;
goto bad;
}
--
2.43.0
