Hi
On Wed, 4 Nov 2026, Kirtikumar Anandrao Ramchandani wrote: > A failed table load can leave a mapped device in a state where its > queue has already been initialized or its disk has been removed, while > md->type is still DM_TYPE_NONE. A later table load then calls > blk_mq_init_allocated_queue() on the same queue. If del_gendisk() exited > the old hardware contexts, blk_mq_exit_hctx() dereferences their cleared > flush queue pointer. > > Reject setup attempts after queue initialization or disk removal. A > failed request queue initialization still leaves md->tag_set NULL and > can be retried. Set the request-based disk operations only after that > initialization succeeds, so an unsuccessful attempt cannot leave a > bio-based retry with request-based operations. > > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=5307e3bcacec2ce4c2f0 > Signed-off-by: Kirtikumar Anandrao Ramchandani <[email protected]> > --- > Changes in v2: > - Resend as plain text after the previous mail client reformatted the diff. > > drivers/md/dm.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/drivers/md/dm.c b/drivers/md/dm.c > index 1881d86..2f3f1ec 100644 > --- a/drivers/md/dm.c > +++ b/drivers/md/dm.c > @@ -2606,13 +2606,17 @@ int dm_setup_md_queue(struct mapped_device > *md, struct dm_table *t) Note ^^^^^^^^^ The patch is accepted, but your mailing software mangled the patch (see the split line above), so I had to type it manually. Please, fix your mailing software. Mikulas > WARN_ON_ONCE(type == DM_TYPE_NONE); > > + /* A failed setup may have left the queue initialized or the disk dead. > */ > + if (md->tag_set || test_bit(GD_DEAD, &md->disk->state)) > + return -ENODEV; > + > if (type == DM_TYPE_REQUEST_BASED) { > - md->disk->fops = &dm_rq_blk_dops; > r = dm_mq_init_request_queue(md, t); > if (r) { > DMERR("Cannot initialize queue for request-based dm > mapped device"); > return r; > } > + md->disk->fops = &dm_rq_blk_dops; > } > > r = dm_calculate_queue_limits(t, &limits); > > base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d >
