Root Cause Analysis

1. Functions, Structs, and Files Involved

• drivers/md/dm.c: dm_setup_md_queue()
• drivers/md/dm-rq.c: dm_mq_init_request_queue()
• drivers/md/dm-ioctl.c: table_load()
• block/blk-mq.c: blk_mq_init_allocated_queue(), __blk_mq_realloc_hw_ctxs(), blk_mq_exit_hctx(), blk_mq_exit_hw_queues(), blk_mq_exit_queue()
• block/genhd.c: __del_gendisk(), del_gendisk()
• Structures: struct mapped_device, struct request_queue, struct blk_mq_hw_ctx, struct blk_flush_queue

2. Trigger Mechanism and Lifecycle Invariant Violation

1. Initial Device Creation & Table Load:

   • A device-mapper device is created via alloc_dev() with md->type = DM_TYPE_NONE, and a request queue is allocated via md->disk = blk_alloc_disk(NULL, ...); md->queue = md->disk->queue;.
   • Userspace issues a DM_TABLE_LOAD ioctl (table_load() in drivers/md/dm-ioctl.c).
   • Seeing that dm_get_md_type(md) == DM_TYPE_NONE, table_load() invokes dm_setup_md_queue(md, t).

2. Transition to Request-Based Queue & Error in dm_setup_md_queue():

   • For a request-based table (type == DM_TYPE_REQUEST_BASED), dm_setup_md_queue() invokes dm_mq_init_request_queue(md, t).
   • dm_mq_init_request_queue() allocates md->tag_set and calls blk_mq_init_allocated_queue(md->tag_set, md->queue).
   • Hardware contexts (struct blk_mq_hw_ctx *hctx) and flush queues (hctx->fq) are allocated and stored in q->queue_hw_ctx[].
   • Next, dm_setup_md_queue() calls add_disk(md->disk).
   • If a subsequent setup step fails (such as bd_link_disk_holder() or dm_sysfs_init()), execution branches to out_undo_holders:

     out_undo_holders:
         list_for_each_entry_continue_reverse(td, &md->table_devices, list)
             bd_unlink_disk_holder(td->dm_dev.bdev, md->disk);
         del_gendisk(md->disk);
         mutex_unlock(&md->table_devices_lock);
         return r;
     

   • del_gendisk(md->disk) executes __del_gendisk(). Because queue_is_mq(q) and test_bit(GD_OWNS_QUEUE, &disk->state) are true, it calls blk_mq_exit_queue(q).
   • blk_mq_exit_queue() invokes blk_mq_exit_hw_queues() -> blk_mq_exit_hctx().
   • blk_mq_exit_hctx() tears down the flush queue:

     call_srcu(&set->tags_srcu, &hctx->fq->rcu_head, blk_free_flush_queue_callback);
     hctx->fq = NULL;
     list_add(&hctx->hctx_list, &q->unused_hctx_list);
     

   • Crucially, del_gendisk() and blk_mq_exit_queue() do not clear q->queue_hw_ctx[].
   • Furthermore, dm_setup_md_queue() returns the error code without ever setting md->type = type. Thus, md->type remains DM_TYPE_NONE, but the mapped device remains active in user space and the DM IDR/hash tables.

3. Subsequent Table Load & NULL Pointer Dereference:

   • Userspace retries DM_TABLE_LOAD on the same mapped device.
   • Because dm_get_md_type(md) is still DM_TYPE_NONE, table_load() calls dm_setup_md_queue(md, t) again.
   • dm_setup_md_queue() again executes dm_mq_init_request_queue(md, t) on md->queue.
   • dm_mq_init_request_queue() allocates a new tag set and calls blk_mq_init_allocated_queue(md->tag_set, md->queue).
   • blk_mq_init_allocated_queue() calls blk_mq_realloc_hw_ctxs(set, q) -> __blk_mq_realloc_hw_ctxs(set, q).
   • In __blk_mq_realloc_hw_ctxs(), the loop checks previously allocated hardware contexts:

     for (i = 0; i < set->nr_hw_queues; i++) {
         int old_node;
         int node = blk_mq_get_hctx_node(set, i);
         struct blk_mq_hw_ctx *old_hctx = hctxs[i];
     
         if (old_hctx) {
             old_node = old_hctx->numa_node;
             blk_mq_exit_hctx(q, set, old_hctx, i);
         }
     

   • Because hctxs[i] (q->queue_hw_ctx[i]) still contains old_hctx from the previous failed run, blk_mq_exit_hctx(q, set, old_hctx, i) is called a second time.
   • At the beginning of blk_mq_exit_hctx() (block/blk-mq.c:3957):

     struct request *flush_rq = hctx->fq->flush_rq;
     

   • Because old_hctx->fq was already cleared to NULL during the previous del_gendisk(), reading hctx->fq->flush_rq attempts to access offset 0x78 of NULL.
   • On 64-bit systems (with KASAN reading shadow memory at 0xdfff800000000000 + (0x78 >> 3) = 0xdfff80000000000f), this triggers a level 1 translation fault and kernel crash (Oops: null-ptr-deref).