| From d26ca855982f25bf44e09984e8d5e8aff3a38a5b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 2 Jul 2020 12:35:02 +0100 |
| Subject: md: raid0/linear: fix dereference before null check on pointer mddev |
| |
| From: Colin Ian King <colin.king@canonical.com> |
| |
| [ Upstream commit 9a5a85972c073f720d81a7ebd08bfe278e6e16db ] |
| |
| Pointer mddev is being dereferenced with a test_bit call before mddev |
| is being null checked, this may cause a null pointer dereference. Fix |
| this by moving the null pointer checks to sanity check mddev before |
| it is dereferenced. |
| |
| Addresses-Coverity: ("Dereference before null check") |
| Fixes: 62f7b1989c02 ("md raid0/linear: Mark array as 'broken' and fail BIOs if a member is gone") |
| Signed-off-by: Colin Ian King <colin.king@canonical.com> |
| Reviewed-by: Guilherme G. Piccoli <gpiccoli@canonical.com> |
| Signed-off-by: Song Liu <songliubraving@fb.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/md/md.c | 9 +++++---- |
| 1 file changed, 5 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/md/md.c b/drivers/md/md.c |
| index 5a378a453a2d4..acef01e519d06 100644 |
| --- a/drivers/md/md.c |
| +++ b/drivers/md/md.c |
| @@ -376,17 +376,18 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio) |
| struct mddev *mddev = q->queuedata; |
| unsigned int sectors; |
| |
| - if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { |
| + if (mddev == NULL || mddev->pers == NULL) { |
| bio_io_error(bio); |
| return BLK_QC_T_NONE; |
| } |
| |
| - blk_queue_split(q, &bio); |
| - |
| - if (mddev == NULL || mddev->pers == NULL) { |
| + if (unlikely(test_bit(MD_BROKEN, &mddev->flags)) && (rw == WRITE)) { |
| bio_io_error(bio); |
| return BLK_QC_T_NONE; |
| } |
| + |
| + blk_queue_split(q, &bio); |
| + |
| if (mddev->ro == 1 && unlikely(rw == WRITE)) { |
| if (bio_sectors(bio) != 0) |
| bio->bi_status = BLK_STS_IOERR; |
| -- |
| 2.25.1 |
| |
