[PATCH v2] dm: avoid double-dropping the zone reset submission reference

[PATCH v2] dm: avoid double-dropping the zone reset submission reference

[Yaohan Li]

On an error in __send_zone_reset_all(), the submission reference
held by the dm_io can be decremented there and again by the caller's
error path.  If another clone is still outstanding, the second drop
can release the dm_io before that clone completes.

Only drop the submission reference in __send_zone_reset_all() on
success.  On failure, leave the reference for the caller's existing
error handling to release once.

The error path was reproduced under KASAN with an injected GFP_NOIO
allocation failure while another zone-reset clone remained in
flight.  With the change, the same failure was reported normally,
without the observed use-after-free, and ordinary zone resets
continued to work.

Fixes: 81e7706345f06 ("dm: handle REQ_OP_ZONE_RESET_ALL")
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>

---
Changes since v1:
- Dropped the nonstandard Assisted-by trailer.
- Added Damien Le Moal's Reviewed-by tag.
v1: https://lore.kernel.org/r/179378374219.68809.15920762511563622507@gmail.com/
---
 drivers/md/dm.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 1881d86111fb2..c373cd3f635fc 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1929,8 +1929,13 @@ static blk_status_t __send_zone_reset_all(struct clone_info *ci)
 			break;
 	}
 
-	/* Release the reference that alloc_io() took for submission. */
-	atomic_sub(1, &ci->io->io_count);
+	/*
+	 * Release the reference that alloc_io() took for submission. On error,
+	 * that reference was not consumed: dm_split_and_process_bio() releases
+	 * it on the error path, so do not release it here a second time.
+	 */
+	if (sts == BLK_STS_OK)
+		atomic_sub(1, &ci->io->io_count);
 
 	return sts;
 }
-- 
2.34.1