Hello,
I am reporting a null-pointer dereference in dm-integrity resume: recovery
mode R skips journal allocation, but dm_integrity_resume() still issues
journal I/O when the on-disk superblock has SB_FLAG_DIRTY_BITMAP.
Summary
=======
create_journal() runs only when mode != 'R', so ic->journal stays NULL.
Resume treats DIRTY_BITMAP as "journal pages hold a bitmap" and calls
rw_journal_sectors() before any journal/mode check:
if (ic->sb->flags & cpu_to_le32(SB_FLAG_DIRTY_BITMAP)) {
rw_journal_sectors(ic, REQ_OP_READ, ...); /* uses ic->journal[] */
rw_journal_sectors() then passes that NULL page list into dm_io():
io_req.mem.type = DM_IO_PAGE_LIST;
io_req.mem.ptr.pl = &ic->journal[pl_index]; /* NULL in mode R */
list_get_page() does *p = pl->page with pl == NULL (KASAN range [0x8-0xf]).
DIRTY_BITMAP is set while bitmap mode (B) is active and is cleared on a
clean postsuspend. It remains on disk after an unclean stop of mode B
(crash / power loss). Reloading that device in recovery mode R is a
documented recovery path and hits this bug.
Affected
========
- Confirmed on Linux 6.6.144 (da47cbc254661aa66d61ef061485a7080305c4be),
KASAN guest
- Still present on torvalds/linux master as of 2026-08-17: resume still
calls rw_journal_sectors() under DIRTY_BITMAP with no journal / mode-R
guard
- Files: drivers/md/dm-integrity.c
- Config: CONFIG_DM=y, CONFIG_DM_INTEGRITY=y (KASAN for the report)
Crash excerpt (from minimized PoC)
==================================
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 234 Comm: repro Not tainted 6.6.144 #15
RIP: 0010:list_get_page+0x7e/0x150
Call Trace:
<TASK>
dispatch_io
sync_io
dm_io
rw_journal_sectors
dm_integrity_resume
dm_table_resume_targets
__dm_resume
dm_resume
dev_suspend
ctl_ioctl
dm_ctl_ioctl
__x64_sys_ioctl
</TASK>
Kernel panic - not syncing: Fatal exception
Full oops and a self-contained Docker/QEMU reproducer (poc.c + KASAN
guest) are available on request.
I am happy to test patches or send the reproducer package.
Thanks,
Yu Junzhe
FuzzAnything <[email protected]>
