Merge tag 'for-6.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/devic...

Pull device mapper updates from Mike Snitzer:

 - Fix use-after-free races due to missing resource cleanup during DM
   target destruction in DM targets: thin-pool, cache, integrity and
   clone.

 - Fix ABBA deadlocks in DM thin-pool and cache targets due to their use
   of a bufio client (that has a shrinker whose locking can cause the
   incorrect locking order).

 - Fix DM cache target to set its needs_check flag after first aborting
   the metadata (whereby using reset persistent-data objects to update
   the superblock with, otherwise the superblock update could be dropped
   due to aborting metadata). This was found with code-inspection when
   comparing with the equivalent in DM thinp code.

 - Fix DM thin-pool's presume to continue resuming the device even if
   the pool in is fail mode -- otherwise bios may never be failed up the
   IO stack (which will prevent resetting the thin-pool target via table
   reload)

 - Fix DM thin-pool's metadata to use proper btree root (from previous
   transaction) if metadata commit failed.

 - Add 'waitfor' module param to DM module (dm_mod) to allow dm-init to
   wait for the specified device before continuing with its DM target
   initialization.

* tag 'for-6.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm thin: Use last transaction's pmd->root when commit failed
  dm init: add dm-mod.waitfor to wait for asynchronously probed block devices
  dm ioctl: fix a couple ioctl codes
  dm ioctl: a small code cleanup in list_version_get_info
  dm thin: resume even if in FAIL mode
  dm cache: set needs_check flag after aborting metadata
  dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
  dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
  dm integrity: Fix UAF in dm_integrity_dtr()
  dm cache: Fix UAF in destroy()
  dm clone: Fix UAF in clone_dtr()
  dm thin: Fix UAF in run_timer_softirq()

diff --combined drivers/md/dm-thin.c
index c2b5a537f5b8adc96ef71ef6af217215bf7cf539,196f82559ad6b97155c0a069fa968322fe07a1d6..64cfcf46881dc5d87d5dfdb5650ba9babd32cd31
--- 1/drivers/md/dm-thin.c
--- 2/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@@ -410,7 -410,7 +410,7 @@@ static void end_discard(struct discard_
                 * need to wait for the chain to complete.
                 */
                bio_chain(op->bio, op->parent_bio);
 -              bio_set_op_attrs(op->bio, REQ_OP_DISCARD, 0);
 +              op->bio->bi_opf = REQ_OP_DISCARD;
                submit_bio(op->bio);
        }
  
@@@ -2889,6 -2889,8 +2889,8 @@@ static void __pool_destroy(struct pool 
        dm_bio_prison_destroy(pool->prison);
        dm_kcopyd_client_destroy(pool->copier);
  
+       cancel_delayed_work_sync(&pool->waker);
+       cancel_delayed_work_sync(&pool->no_space_timeout);
        if (pool->wq)
                destroy_workqueue(pool->wq);
  
@@@ -3540,20 -3542,28 +3542,28 @@@ static int pool_preresume(struct dm_tar
         */
        r = bind_control_target(pool, ti);
        if (r)
-               return r;
+               goto out;
  
        r = maybe_resize_data_dev(ti, &need_commit1);
        if (r)
-               return r;
+               goto out;
  
        r = maybe_resize_metadata_dev(ti, &need_commit2);
        if (r)
-               return r;
+               goto out;
  
        if (need_commit1 || need_commit2)
                (void) commit(pool);
+ out:
+       /*
+        * When a thin-pool is PM_FAIL, it cannot be rebuilt if
+        * bio is in deferred list. Therefore need to return 0
+        * to allow pool_resume() to flush IO.
+        */
+       if (r && get_pool_mode(pool) == PM_FAIL)
+               r = 0;
  
-       return 0;
+       return r;
  }
  
  static void pool_suspend_active_thins(struct pool *pool)