When doing re-add, we need to ensure rdev->mddev->pers is not NULL, which can avoid potential NULL pointer derefence in fallowing add_bound_rdev().
Fixes: a6da4ef85cef ("md: re-add a failed disk") Cc: Xiao Ni xni@redhat.com Cc: NeilBrown neilb@suse.com Cc: stable@vger.kernel.org Signed-off-by: Yufen Yu yuyufen@huawei.com --- drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c index 875b29ba5926..66b6bdf9f364 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len) err = 0; } } else if (cmd_match(buf, "re-add")) { - if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && - rdev->saved_raid_disk >= 0) { + if (!rdev->mddev->pers) + err = -EINVAL; + else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && + rdev->saved_raid_disk >= 0) { /* clear_bit is performed _after_ all the devices * have their local Faulty bit cleared. If any writes * happen in the meantime in the local node, they
On Tue, Apr 02 2019, Yufen Yu wrote:
When doing re-add, we need to ensure rdev->mddev->pers is not NULL, which can avoid potential NULL pointer derefence in fallowing add_bound_rdev().
Fixes: a6da4ef85cef ("md: re-add a failed disk") Cc: Xiao Ni xni@redhat.com Cc: NeilBrown neilb@suse.com Cc: stable@vger.kernel.org Signed-off-by: Yufen Yu yuyufen@huawei.com
Reviewed-by: NeilBrown neilb@suse.com
Thanks, NeilBrown
drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c index 875b29ba5926..66b6bdf9f364 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len) err = 0; } } else if (cmd_match(buf, "re-add")) {
if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&rdev->saved_raid_disk >= 0) {
if (!rdev->mddev->pers)err = -EINVAL;else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&rdev->saved_raid_disk >= 0) { /* clear_bit is performed _after_ all the devices * have their local Faulty bit cleared. If any writes * happen in the meantime in the local node, they-- 2.16.2.dirty
On Apr 2, 2019, at 2:11 PM, NeilBrown neilb@suse.com wrote:
On Tue, Apr 02 2019, Yufen Yu wrote:
When doing re-add, we need to ensure rdev->mddev->pers is not NULL, which can avoid potential NULL pointer derefence in fallowing add_bound_rdev().
Fixes: a6da4ef85cef ("md: re-add a failed disk") Cc: Xiao Ni xni@redhat.com Cc: NeilBrown neilb@suse.com Cc: stable@vger.kernel.org Signed-off-by: Yufen Yu yuyufen@huawei.com
Reviewed-by: NeilBrown neilb@suse.com
Thanks, NeilBrown
Thanks Yufen and Neil.
I applied it to the md-next branch:
https://github.com/liu-song-6/linux/tree/md-next
Song
drivers/md/md.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c index 875b29ba5926..66b6bdf9f364 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len) err = 0; } } else if (cmd_match(buf, "re-add")) {
if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&rdev->saved_raid_disk >= 0) {
if (!rdev->mddev->pers)err = -EINVAL;else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&rdev->saved_raid_disk >= 0) { /* clear_bit is performed _after_ all the devices * have their local Faulty bit cleared. If any writes * happen in the meantime in the local node, they-- 2.16.2.dirty
linux-stable-mirror@lists.linaro.org
-
NeilBrown -
Song Liu -
Yufen Yu