If the superblock for a dm-integrity device is changed while the device is suspended, it will resume in a failed state, and skip replay_journal(). If this happens on a journaled dm-integriry table's first resume, replay_journal() will have never been called, and the journal will be uninitialized. While nothing can write to the device in this state, integrity_commit() will be called if it receives a flush request as well as on suspend. Even through there is nothing to commit, pad_uncommitted() will check that the journal accounting is sane. This triggers a kernel warning because the accounting was never set up by replay_journal(). Fix this by setting free_sectors equal to journal_entries. Since all the accounting variables are zeroed when creating the ic structure, setting free_sectors is all that's necessary to mimic a cleared journal. Reported-by: syzbot+94dac3c75477e184f0b0@syzkaller.appspotmail.com Closes: https://syzbot.org/bug?extid=94dac3c75477e184f0b0 Fixes: fc79aeb86a2c ("dm-integrity: validate the superblock on resume") Cc: stable@vger.kernel.org Signed-off-by: Benjamin Marzinski --- drivers/md/dm-integrity.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index 1659a11a1a29..419a8b958371 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -5430,6 +5430,12 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv if (r) goto bad; + /* + * initialize journal accounting like a cleared journal, to + * handle a changed superblock on resume, where the journal + * is not replayed. + */ + ic->free_sectors = ic->journal_entries; } if (ic->mode == 'B') { -- 2.56.0