[PATCH] dm table: don't inherit live table's type for request-based tables

[PATCH] dm table: don't inherit live table's type for request-based tables

[Alexander Ivanov]

A request-based table without devices inherits the live table's type
in dm_table_determine_type(). Since commit 6936c12cf809 ("dm table: fix
'all_blk_mq' inconsistency when an empty table is loaded") this
includes bio-based types, although the inheritance was meant to pick a
variant of the request-based type, and only one is left now. So a
request-based table loaded over a bio-based device becomes bio-based,
which its target cannot handle.

A multipath table with no paths and the default rq queue_mode keeps
m->queue_mode request-based while the table is bio-based. Its
per_io_data_size is sized for a request, so the first bio overruns its
per-bio data in multipath_map_bio():

  BUG: KASAN: slab-out-of-bounds in multipath_map_bio+0x376/0x380
   __map_bio+0x433/0x4f0
   dm_submit_bio+0x48a/0x1620

Removing the device then kicks the requeue work of a bio-based queue,
which was never initialized, from multipath_presuspend():

  WARNING: kernel/workqueue.c:2606 at __queue_delayed_work+0x29c/0x340
   mod_delayed_work_on+0xee/0x100
   kblockd_mod_delayed_work_on+0x16/0x20
   dm_table_presuspend_targets+0xdf/0x160
   __dm_destroy+0x41b/0x530

Drop the inheritance. table_load() then rejects such a table with
"can't change device type", as it does for request-based tables with
devices.

Fixes: 6936c12cf809 ("dm table: fix 'all_blk_mq' inconsistency when an empty table is loaded")
Signed-off-by: Alexander Ivanov <alexander.ivanov@virtuozzo.com>
---
 drivers/md/dm-table.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index a483f49dd4ce..c5e55b4a527c 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -967,16 +967,8 @@ static int dm_table_determine_type(struct dm_table *t)
 		return -EINVAL;
 	}
 
-	if (list_empty(devices)) {
-		int srcu_idx;
-		struct dm_table *live_table = dm_get_live_table(t->md, &srcu_idx);
-
-		/* inherit live table's type */
-		if (live_table)
-			t->type = live_table->type;
-		dm_put_live_table(t->md, srcu_idx);
+	if (list_empty(devices))
 		return 0;
-	}
 
 	ti = dm_table_get_immutable_target(t);
 	if (!ti) {
-- 
2.53.0