* [PATCH v2] md: add mddev->pers to avoid potential NULL pointer dereference
@ 2019-04-02 6:22 ` Yufen Yu
0 siblings, 0 replies; 4+ messages in thread
From: Yufen Yu @ 2019-04-02 6:22 UTC (permalink / raw)
To: axboe, songliubraving; +Cc: neilb, xni, linux-raid, stable
When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
which can avoid potential NULL pointer derefence in fallowing
add_bound_rdev().
Fixes: a6da4ef85cef ("md: re-add a failed disk")
Cc: Xiao Ni <xni@redhat.com>
Cc: NeilBrown <neilb@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
---
drivers/md/md.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 875b29ba5926..66b6bdf9f364 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
err = 0;
}
} else if (cmd_match(buf, "re-add")) {
- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
- rdev->saved_raid_disk >= 0) {
+ if (!rdev->mddev->pers)
+ err = -EINVAL;
+ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+ rdev->saved_raid_disk >= 0) {
/* clear_bit is performed _after_ all the devices
* have their local Faulty bit cleared. If any writes
* happen in the meantime in the local node, they
--
2.16.2.dirty
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v2] md: add mddev->pers to avoid potential NULL pointer dereference
@ 2019-04-02 6:22 ` Yufen Yu
0 siblings, 0 replies; 4+ messages in thread
From: Yufen Yu @ 2019-04-02 6:22 UTC (permalink / raw)
To: axboe, songliubraving; +Cc: neilb, xni, linux-raid, stable
When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
which can avoid potential NULL pointer derefence in fallowing
add_bound_rdev().
Fixes: a6da4ef85cef ("md: re-add a failed disk")
Cc: Xiao Ni <xni@redhat.com>
Cc: NeilBrown <neilb@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
---
drivers/md/md.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 875b29ba5926..66b6bdf9f364 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
err = 0;
}
} else if (cmd_match(buf, "re-add")) {
- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
- rdev->saved_raid_disk >= 0) {
+ if (!rdev->mddev->pers)
+ err = -EINVAL;
+ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+ rdev->saved_raid_disk >= 0) {
/* clear_bit is performed _after_ all the devices
* have their local Faulty bit cleared. If any writes
* happen in the meantime in the local node, they
--
2.16.2.dirty
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] md: add mddev->pers to avoid potential NULL pointer dereference
2019-04-02 6:22 ` Yufen Yu
(?)
@ 2019-04-02 21:11 ` NeilBrown
2019-04-02 22:41 ` Song Liu
-1 siblings, 1 reply; 4+ messages in thread
From: NeilBrown @ 2019-04-02 21:11 UTC (permalink / raw)
To: Yufen Yu, axboe, songliubraving; +Cc: xni, linux-raid, stable
[-- Attachment #1: Type: text/plain, Size: 1330 bytes --]
On Tue, Apr 02 2019, Yufen Yu wrote:
> When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
> which can avoid potential NULL pointer derefence in fallowing
> add_bound_rdev().
>
> Fixes: a6da4ef85cef ("md: re-add a failed disk")
> Cc: Xiao Ni <xni@redhat.com>
> Cc: NeilBrown <neilb@suse.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Reviewed-by: NeilBrown <neilb@suse.com>
Thanks,
NeilBrown
> ---
> drivers/md/md.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 875b29ba5926..66b6bdf9f364 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
> err = 0;
> }
> } else if (cmd_match(buf, "re-add")) {
> - if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
> - rdev->saved_raid_disk >= 0) {
> + if (!rdev->mddev->pers)
> + err = -EINVAL;
> + else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
> + rdev->saved_raid_disk >= 0) {
> /* clear_bit is performed _after_ all the devices
> * have their local Faulty bit cleared. If any writes
> * happen in the meantime in the local node, they
> --
> 2.16.2.dirty
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] md: add mddev->pers to avoid potential NULL pointer dereference
2019-04-02 21:11 ` NeilBrown
@ 2019-04-02 22:41 ` Song Liu
0 siblings, 0 replies; 4+ messages in thread
From: Song Liu @ 2019-04-02 22:41 UTC (permalink / raw)
To: NeilBrown; +Cc: Yufen Yu, axboe, xni, linux-raid, stable
> On Apr 2, 2019, at 2:11 PM, NeilBrown <neilb@suse.com> wrote:
>
> On Tue, Apr 02 2019, Yufen Yu wrote:
>
>> When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
>> which can avoid potential NULL pointer derefence in fallowing
>> add_bound_rdev().
>>
>> Fixes: a6da4ef85cef ("md: re-add a failed disk")
>> Cc: Xiao Ni <xni@redhat.com>
>> Cc: NeilBrown <neilb@suse.com>
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Yufen Yu <yuyufen@huawei.com>
>
> Reviewed-by: NeilBrown <neilb@suse.com>
>
> Thanks,
> NeilBrown
Thanks Yufen and Neil.
I applied it to the md-next branch:
https://github.com/liu-song-6/linux/tree/md-next
Song
>
>> ---
>> drivers/md/md.c | 6 ++++--
>> 1 file changed, 4 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/md/md.c b/drivers/md/md.c
>> index 875b29ba5926..66b6bdf9f364 100644
>> --- a/drivers/md/md.c
>> +++ b/drivers/md/md.c
>> @@ -2859,8 +2859,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
>> err = 0;
>> }
>> } else if (cmd_match(buf, "re-add")) {
>> - if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
>> - rdev->saved_raid_disk >= 0) {
>> + if (!rdev->mddev->pers)
>> + err = -EINVAL;
>> + else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
>> + rdev->saved_raid_disk >= 0) {
>> /* clear_bit is performed _after_ all the devices
>> * have their local Faulty bit cleared. If any writes
>> * happen in the meantime in the local node, they
>> --
>> 2.16.2.dirty
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-04-02 22:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-02 6:22 [PATCH v2] md: add mddev->pers to avoid potential NULL pointer dereference Yufen Yu
2019-04-02 6:22 ` Yufen Yu
2019-04-02 21:11 ` NeilBrown
2019-04-02 22:41 ` Song Liu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.