【OLK-5.10】dm-mpath压力测试中出现访问空指针

【标题描述】能够简要描述问题：说明什么场景下，做了什么操作，出现什么问题（尽量使用正向表达方式）
【环境信息】

【标题描述】dm-mpath压力测试中出现访问空指针
【环境信息】
【问题复现步骤】
复现方法：
1.在内核中添加如下延时：
```
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 2b1db5135250..a02e5a48e90a 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1301,6 +1301,7 @@ static bool is_valid_type(enum dm_queue_mode cur, enum dm_queue_mode new)
        return false;
 }

+#include <linux/delay.h>
 static int table_load(struct file *filp, struct dm_ioctl *param, size_t param_size)
 {
        int r;
@@ -1343,6 +1344,7 @@ static int table_load(struct file *filp, struct dm_ioctl *param, size_t param_si
                        DMWARN("unable to set up device queue for new table.");
                        goto err_unlock_md_type;
                }
+               msleep(10 * 1000);
        } else if (!is_valid_type(dm_get_md_type(md), dm_table_get_type(t))) {
                DMWARN("can't change device type (old=%u vs new=%u) after initial table load.",
                       dm_get_md_type(md), dm_table_get_type(t));
```
以上代码在table load完成后增加一个10s的延时。

2. 使用以下脚本加载iscsi和mpath服务
```
#!/bin/sh

ifconfig lo:0 127.0.0.2 up
ifconfig lo:1 127.0.0.3 up
ifconfig lo:2 127.0.0.4 up

# iscsi
cat << EOF > /etc/tgt/targets.conf
    <target iqn.2019-04.jenkins.disk>
            backing-store /dev/sda #使用sda作为后端设备
    </target>
EOF

service tgtd restart

# dm multipath
cat << EOF > /etc/multipath.conf
blacklist {
	devnode "^(ram|raw|loop|fd|md|dm-|sr|scd|st|pmem)[0-9]*"
	devnode "^hd[a-z][[0-9]*]"
	devnode "^vd[a-z][[0-9]*]"
	devnode "^cciss!c[0-9]d[0-9]*[p[0-9]*]"
}
defaults {
	path_checker            tur
	no_path_retry           18
	path_grouping_policy    group_by_prio
	prio                    const
	deferred_remove         yes
	uid_attribute           "ID_SERIAL"
	reassign_maps           no
	failback                immediate
	log_checker_err         once
}
multipaths {
	multipath {
		wwid                    360000000000000000e00000000010001
		alias                   mpath_disk          #磁盘别名
		path_selector           "service-time 0"    #负载均衡模式
	}
}
EOF

service multipathd restart
service iscsid restart
iscsiadm -m discovery -p 127.0.0.2 -t st
iscsiadm -m discovery -p 127.0.0.3 -t st
iscsiadm -m discovery -p 127.0.0.4 -t st
iscsiadm -m node -u  ##登出iscsi设备
iscsiadm -m node -u
iscsiadm -m node -l  ##登录iscsi设备，使用完毕后通过-u登出
```
3. 执行mpath加载的过程中并发的去挂载文件系统
multipath -v2 &
sleep 1
mount /dev/dm-0 /mnt  #mount命令所在的util-linux版本需要为2.34

问题必现：
```
[  143.165307] VFS: Open an write opened block device exclusively sda [1076 multipath].
[  145.054399] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0
[  145.058564] PGD 0 P4D 0
[  145.059374] Oops: 0000 [#1] SMP
[  145.060290] CPU: 0 PID: 314 Comm: kworker/0:1H Not tainted 4.18.0 #142
[  145.061314] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
[  145.063386] Workqueue: kblockd blk_mq_run_work_fn
[  145.064131] RIP: 0010:dm_table_find_target+0x5/0xe0
[  145.064897] Code: 48 8d 14 46 48 8b 87 e0 00 00 00 48 8d 04 d0 c3 48 83 05 5d bb ec 03 01 31 c0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <8b> 87 d0 00 00 00 85 c0 75 1c 48 8d 14 80 48 83 05 5d bb ec 01
[  145.067786] RSP: 0018:ffffc90005e63cf0 EFLAGS: 00010202
[  145.068603] RAX: 0000000000000000 RBX: ffff88812938e000 RCX: 0000000000000000
[  145.069711] RDX: 00006077da236040 RSI: 0000000000000000 RDI: 0000000000000000
[  145.070809] RBP: ffff8881278c0000 R08: 0000000000000000 R09: 0000000000000000
[  145.071854] R10: 8080808080808080 R11: 0000000000000018 R12: 0000000000000000
[  145.072812] R13: ffff88812938e120 R14: ffff88812938e048 R15: ffff8881278f8000
[  145.073774] FS:  0000000000000000(0000) GS:ffff888825400000(0000) knlGS:0000000000000000
[  145.074859] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  145.075636] CR2: 00000000000000d0 CR3: 000000010de09000 CR4: 00000000000006f0
[  145.076597] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  145.077559] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  145.078523] Call Trace:
[  145.078871]  dm_mq_queue_rq+0x411/0x5a0
[  145.079411]  ? blk_mq_get_driver_tag+0xf0/0x170
[  145.080030]  blk_mq_dispatch_rq_list+0x29f/0xc70
[  145.080654]  ? elv_rb_del+0x27/0x60
[  145.081131]  ? deadline_remove_request+0x98/0x110
[  145.081774]  blk_mq_do_dispatch_sched+0x6c/0x1b0
[  145.082402]  blk_mq_sched_dispatch_requests+0x222/0x2b0
[  145.083115]  __blk_mq_run_hw_queue+0x93/0x1a0
[  145.083707]  blk_mq_run_work_fn+0x27/0x30
[  145.084258]  process_one_work+0x25e/0x650
[  145.084782]  worker_thread+0x280/0x6c0
[  145.085277]  ? rescuer_thread+0x580/0x580
[  145.085802]  kthread+0x168/0x1a0
[  145.086236]  ? kthread_flush_work+0x180/0x180
[  145.086808]  ret_from_fork+0x1f/0x30
[  145.087288] Modules linked in:
[  145.087701] CR2: 00000000000000d0
[  145.088179] ---[ end trace 74c68081ad8d6ca8 ]---
```
问题根因：
该问题的根因为以下并发场景:
```
multipath -v2                  mount
ioctl(DM_DEV_CREATE_CMD)
ioctl(DM_TABLE_LOAD_CMD)
                               read super block
                                blk_mq_dispatch_rq_list()
                                 dm_mq_queue_rq()
                                  md->immutable_target is NULL;
                                  map = dm_get_live_table() //NULL Pointer
ioctl(DM_DEV_SUSPEND_CMD)
__bind()
 set new map
 set md->immutable_target
```
dm-mpath设备在创建时，执行完DM_TABLE_LOAD_CMD后map并没有被绑定到md设备上（真正的绑定动作是在后续的DM_DEV_SUSPEND_CMD ioctl中完成），但是dm-0的设备已经创建完成了，此时可以下IO，在IO request提交的过程中无法获取到md->immutable_target且map也是空的，但是在dm_mq_queue_rq()函数中没有保护，因此触发空指针解引用问题。

GVP openEuler/kernel

内容风险标识

评论 (2)

GVPopenEuler/kernel

内容风险标识