Yufen Yu c356cd64f0 md: fix NULL dereference of mddev->pers in remove_and_add_spares() ... [ Upstream commit c42a0e2675 ] We met NULL pointer BUG as follow: [ 151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 [ 151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0 [ 151.762039] Oops: 0000 [#1] SMP PTI [ 151.762406] Modules linked in: [ 151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238 [ 151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014 [ 151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0 [ 151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246 [ 151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000 [ 151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000 [ 151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051 [ 151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600 [ 151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000 [ 151.769160] FS: 00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000 [ 151.769971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0 [ 151.771272] Call Trace: [ 151.771542] md_ioctl+0x1df2/0x1e10 [ 151.771906] ? __switch_to+0x129/0x440 [ 151.772295] ? __schedule+0x244/0x850 [ 151.772672] blkdev_ioctl+0x4bd/0x970 [ 151.773048] block_ioctl+0x39/0x40 [ 151.773402] do_vfs_ioctl+0xa4/0x610 [ 151.773770] ? dput.part.23+0x87/0x100 [ 151.774151] ksys_ioctl+0x70/0x80 [ 151.774493] __x64_sys_ioctl+0x16/0x20 [ 151.774877] do_syscall_64+0x5b/0x180 [ 151.775258] entry_SYSCALL_64_after_hwframe+0x44/0xa9 For raid6, when two disk of the array are offline, two spare disks can be added into the array. Before spare disks recovery completing, system reboot and mdadm thinks it is ok to restart the degraded array by md_ioctl(). Since disks in raid6 is not only_parity(), raid5_run() will abort, when there is no PPL feature or not setting 'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL. But, mddev->raid_disks has been set and it will not be cleared when raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to remove a disk by mdadm, which will cause NULL pointer dereference in remove_and_add_spares() finally. Signed-off-by: Yufen Yu <yuyufen@huawei.com> Signed-off-by: Shaohua Li <shli@fb.com> Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-08-06 16:24:35 +02:00
..
bcache	bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set	2018-05-30 07:49:11 +02:00
persistent-data	dm btree: fix serious bug in btree_split_beneath()	2018-01-23 19:50:16 +01:00
bitmap.c	md/bitmap: disable bitmap_resize for file-backed bitmaps.	2017-09-27 11:00:14 +02:00
bitmap.h
dm-bio-prison.c
dm-bio-prison.h
dm-bio-record.h
dm-bufio.c	dm bufio: don't take the lock in dm_bufio_shrink_count	2018-07-11 16:03:51 +02:00
dm-bufio.h
dm-builtin.c
dm-cache-block-types.h
dm-cache-metadata.c	dm cache metadata: fail operations if fail_io mode has been established	2017-05-25 14:30:08 +02:00
dm-cache-metadata.h
dm-cache-policy-cleaner.c
dm-cache-policy-internal.h
dm-cache-policy-mq.c
dm-cache-policy-smq.c
dm-cache-policy.c
dm-cache-policy.h
dm-cache-target.c	dm cache: fix corruption seen when using cache > 2TB	2017-03-12 06:37:26 +01:00
dm-crypt.c	dm crypt: mark key as invalid until properly loaded	2017-01-06 11:16:15 +01:00
dm-delay.c
dm-era-target.c	dm era: save spacemap metadata root after the pre-commit	2017-05-20 14:27:00 +02:00
dm-exception-store.c
dm-exception-store.h
dm-flakey.c	dm flakey: return -EINVAL on interval bounds error in flakey_ctr()	2017-01-06 11:16:15 +01:00
dm-io.c	dm io: fix duplicate bio completion due to missing ref count	2018-03-11 16:19:47 +01:00
dm-ioctl.c	dm ioctl: remove double parentheses	2018-04-08 11:51:57 +02:00
dm-kcopyd.c
dm-linear.c
dm-log-userspace-base.c
dm-log-userspace-transfer.c
dm-log-userspace-transfer.h
dm-log-writes.c	dm log writes: fix bug with too large bios	2016-10-07 15:23:47 +02:00
dm-log.c
dm-mpath.c	dm mpath: check if path's request_queue is dying in activate_path()	2016-10-28 03:01:28 -04:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid.c
dm-raid1.c	dm mirror: fix read error on recovery after default leg failure	2016-11-10 16:36:35 +01:00
dm-region-hash.c
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c
dm-snap-transient.c
dm-snap.c
dm-stats.c	dm stats: fix a leaked s->histogram_boundaries array	2017-03-12 06:37:26 +01:00
dm-stats.h
dm-stripe.c
dm-switch.c
dm-sysfs.c
dm-table.c
dm-target.c
dm-thin-metadata.c	dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6	2018-01-23 19:50:17 +01:00
dm-thin-metadata.h
dm-thin.c	dm thin: handle running out of data space vs concurrent discard	2018-07-03 11:21:35 +02:00
dm-uevent.c
dm-uevent.h
dm-verity.c
dm-zero.c
dm.c	dm: correctly handle chained bios in dec_pending()	2018-02-22 15:45:01 +01:00
dm.h
faulty.c
Kconfig	dm raid: select the Kconfig option CONFIG_MD_RAID0	2017-05-25 14:30:07 +02:00
linear.c	md/linear: shutup lockdep warnning	2017-10-21 17:09:05 +02:00
linear.h	md linear: fix a race between linear_add() and linear_congested()	2017-03-12 06:37:30 +01:00
Makefile
md-cluster.c	md-cluster: fix potential lock issue in add_new_disk	2018-04-13 19:50:09 +02:00
md-cluster.h
md.c	md: fix NULL dereference of mddev->pers in remove_and_add_spares()	2018-08-06 16:24:35 +02:00
md.h
multipath.c
multipath.h
raid1.c	md/raid1: fix NULL pointer dereference	2018-05-30 07:49:01 +02:00
raid1.h
raid5-cache.c
raid5.c	md: raid5: avoid string overflow warning	2018-05-30 07:49:00 +02:00
raid5.h
raid10.c	md raid10: fix NULL deference in handle_write_completed()	2018-05-30 07:48:59 +02:00
raid10.h
raid0.c
raid0.h