Re: [PATCH] dm: reject kcopyd client destroy if it setup failed

[Nehuen Lian Bova <nehuenlian.kernel@gmail.com>]

Hi Edward,

I reproduced this bug using the syzkaller repro on a kernel built
from the reported commit.

Effectively, in "drivers/md/dm-cache-target.c", if the execution path
ends up in a bad_* goto, *kc (which is cache->copier in cache_create) will
be freed and the function will return an error pointer, but cache->copier 
will be dereferenced later in dm_kcopyd_client_destroy, causing the bug.

With your change the reproducer loops on "could not create kcopyd 
client", which means the null ptr deref is gone.

I suggest removing (or trimming) the call trace in the commit description
(is already available in the syzbot report linked in the patch) to keep 
it cleaner.

With that small change in the commit description you can add my:
Reviewed-by: Nehuen Lian Bova <nehuenlian.kernel@gmail.com>
Tested-by: Nehuen Lian Bova <nehuenlian.kernel@gmail.com>

Thanks,
Nehuen Lian Bova