snapshot_io_hints() copies the snapshot store's chunk_size, which is
in 512-byte sectors, into queue_limits.discard_granularity, which, like
all other members of struct queue_limits, is in bytes.
For snapshots with a chunk size smaller than 512 sectors, e.g. the
16 KiB (32-sector) chunks created by the syzkaller reproducer, the
resulting granularity is smaller than a single sector. When
dm_calculate_queue_limits() then stacks the target limits into the
table limits:
blk_stack_limits(limits, &ti_limits, 0)
queue_limit_discard_alignment() truncates that granularity to zero
sectors and sector_div() divides by zero:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:queue_limit_discard_alignment block/blk-settings.c:645 [inline]
RIP: 0010:blk_stack_limits+0x1105/0x2d00 block/blk-settings.c:916
Call Trace:
dm_calculate_queue_limits+0x70c/0x1510 drivers/md/dm-table.c:1823
dm_setup_md_queue+0x199/0x4f0 drivers/md/dm.c:2618
table_load+0x4fd/0x8a0 drivers/md/dm-ioctl.c:1661
The divide fault itself only became reachable when commit e924da7d6622
("block: Drop granularity check in queue_limit_discard_alignment()")
removed the check for a sub-sector granularity in v6.13. Kernels
before that returned a zero discard alignment instead of faulting, but
they still advertised a granularity 512 times too small.
Use the same chunk_size << SECTOR_SHIFT conversion that
io_overlaps_chunk() already applies to turn chunk_size into bytes.
Fixes: 2e6023850e17 ("dm snapshot: add optional discard support features")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=1288484b13bf6af3620d
Cc: [email protected]
Signed-off-by: wuyuehong <[email protected]>
---
drivers/md/dm-snap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 797c432594d8..31676ee05514 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -2414,7 +2414,7 @@ static void snapshot_io_hints(struct dm_target *ti,
struct queue_limits *limits)
snap = snap_src;
/* All discards are split on chunk_size boundary */
- limits->discard_granularity = snap->store->chunk_size;
+ limits->discard_granularity = snap->store->chunk_size <<
SECTOR_SHIFT;
limits->max_hw_discard_sectors = snap->store->chunk_size;
up_read(&_origins_lock);
--
2.43.0
