Commit 7718714e authored Jun 03, 2023 by Li Nan Committed by Jialin Zhang Jun 03, 2023

md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

hulk inclusion
category: bugfix
bugzilla: 188527, https://gitee.com/openeuler/kernel/issues/I6O3HO


CVE: NA

--------------------------------

need_replace will be set to 1 if no-Faulty mreplace exists, and mreplace
will be deref later. However, the latter check of mreplace might set
mreplace to NULL, null-ptr-deref occurs if need_replace is 1 at this time.

Fix it by merging two checks into one.

Fixes: ee37d731 ("md/raid10: Fix raid10 replace hang when new added disk faulty")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Hou Tao <houtao1@huawei.com>

parent e8025850

drivers/md/raid10.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -3105,6 +3105,8 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
		if (mreplace != NULL &&
		!test_bit(Faulty, &mreplace->flags))
		need_replace = 1;
		else
		mreplace = NULL;

		if (!need_recover && !need_replace) {
		rcu_read_unlock();
		@@ -3122,8 +3124,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
		rcu_read_unlock();
		continue;
		}
		if (mreplace && test_bit(Faulty, &mreplace->flags))
		mreplace = NULL;
		/* Unless we are doing a full sync, or a replacement
		* we only need to recover the block if it is set in
		* the bitmap