Re: [syzbot] [dm?] BUG: unable to handle kernel NULL pointer dereference in dm_bufio_client_create

[Edward Adam Davis <eadavis@sina.com>]

From: Edward Aadm Davis <eadavis@sina.com>

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git abf8c33470f7

diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 358ed77ffb2b..f15d5815ffab 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3292,6 +3292,7 @@ static int pool_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	dm_block_t low_water_blocks;
 	struct dm_dev *metadata_dev;
 	blk_mode_t metadata_mode;
+	struct block_device *md_bdev, *data_bdev;
 
 	/*
 	 * FIXME Remove validation from scope of lock.
@@ -3331,6 +3332,7 @@ static int pool_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		ti->error = "Error opening metadata block device";
 		goto out_unlock;
 	}
+	md_bdev = metadata_dev->bdev;
 	warn_if_metadata_device_too_big(metadata_dev->bdev);
 
 	r = dm_get_device(ti, argv[1], BLK_OPEN_READ | BLK_OPEN_WRITE, &data_dev);
@@ -3338,6 +3340,9 @@ static int pool_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		ti->error = "Error getting data device";
 		goto out_metadata;
 	}
+	data_bdev = data_dev->bdev;
+	if (md_bdev == data_bdev)
+		metadata_dev = data_dev;
 
 	if (kstrtoul(argv[2], 10, &block_size) || !block_size ||
 	    block_size < DATA_DEV_BLOCK_SIZE_MIN_SECTORS ||
@@ -3428,7 +3433,8 @@ static int pool_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 out:
 	dm_put_device(ti, data_dev);
 out_metadata:
-	dm_put_device(ti, metadata_dev);
+	if (md_bdev != data_bdev)
+		dm_put_device(ti, metadata_dev);
 out_unlock:
 	mutex_unlock(&dm_thin_pool_table.mutex);