Hi

This is backport of patches d208b89401e0 ("dm: fix mempool NULL pointer race when completing IO") and 9f6dc6337610 ("dm: interlock pending dm_io and dm_wait_for_bios_completion") for the kernel 5.4.

The bugs fixed by these patches can cause random crashing when reloading dm table, so it is eligible for stable backport.

This patch is different from the upstream patches because the code diverged significantly.

Signed-off-by: Mikulas Patocka mpatocka@redhat.com

--- drivers/md/dm.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)

Index: linux-stable/drivers/md/dm.c =================================================================== --- linux-stable.orig/drivers/md/dm.c 2022-04-19 16:25:08.000000000 +0200 +++ linux-stable/drivers/md/dm.c 2022-04-19 16:26:18.000000000 +0200 @@ -676,20 +676,27 @@ static void start_io_acct(struct dm_io * false, 0, &io->stats_aux); }

+static void free_io(struct mapped_device *md, struct dm_io *io); + static void end_io_acct(struct dm_io *io) { struct mapped_device *md = io->md; struct bio *bio = io->orig_bio; - unsigned long duration = jiffies - io->start_time; - - generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, - io->start_time); + unsigned long start_time = io->start_time; + unsigned long duration = jiffies - start_time;

if (unlikely(dm_stats_used(&md->stats))) dm_stats_account_io(&md->stats, bio_data_dir(bio), bio->bi_iter.bi_sector, bio_sectors(bio), true, duration, &io->stats_aux);

+ free_io(md, io); + + smp_wmb(); + + generic_end_io_acct(md->queue, bio_op(bio), &dm_disk(md)->part0, + start_time); + /* nudge anyone waiting on suspend queue */ if (unlikely(wq_has_sleeper(&md->wait))) wake_up(&md->wait); @@ -936,7 +943,6 @@ static void dec_pending(struct dm_io *io io_error = io->status; bio = io->orig_bio; end_io_acct(io); - free_io(md, io);

if (io_error == BLK_STS_DM_REQUEUE) return; @@ -2491,6 +2497,8 @@ static int dm_wait_for_completion(struct } finish_wait(&md->wait, &wait);

+ smp_rmb(); + return r; }