No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Li Nan 14964127be md/raid10: fix null-ptr-deref in raid10_sync_request
commit a405c6f0229526160aa3f177f65e20c86fce84c5 upstream.

init_resync() inits mempool and sets conf->have_replacemnt at the beginning
of sync, close_sync() frees the mempool when sync is completed.

After [1] recovery might be skipped and init_resync() is called but
close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio.

The following is one way to reproduce the issue.

  1) create a array, wait for resync to complete, mddev->recovery_cp is set
     to MaxSector.
  2) recovery is woken and it is skipped. conf->have_replacement is set to
     0 in init_resync(). close_sync() not called.
  3) some io errors and rdev A is set to WantReplacement.
  4) a new device is added and set to A's replacement.
  5) recovery is woken, A have replacement, but conf->have_replacemnt is
     0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref
     occurs.

Fix it by not calling init_resync() if recovery skipped.

[1] commit 7e83ccbecd ("md/raid10: Allow skipping recovery when clean arrays are assembled")
Fixes: 7e83ccbecd ("md/raid10: Allow skipping recovery when clean arrays are assembled")
Cc: stable@vger.kernel.org
Signed-off-by: Li Nan <linan122@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230222041000.3341651-3-linan666@huaweicloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:35:55 +02:00
arch parisc: Fix argument pointer in real64_call_asm() 2023-05-17 11:35:54 +02:00
block
certs
crypto crypto: drbg - Only fail when jent is unavailable in FIPS mode 2023-05-17 11:35:42 +02:00
Documentation media: uapi: add MEDIA_BUS_FMT_METADATA_FIXED media bus format. 2023-05-17 11:35:36 +02:00
drivers md/raid10: fix null-ptr-deref in raid10_sync_request 2023-05-17 11:35:55 +02:00
fs nilfs2: fix infinite loop in nilfs_mdt_get_block() 2023-05-17 11:35:54 +02:00
include SUNRPC: remove the maximum number of retries in call_bind_status 2023-05-17 11:35:52 +02:00
init
ipc
kernel perf/core: Fix hardlockup failure caused by perf throttle 2023-05-17 11:35:50 +02:00
lib debugobject: Prevent init race with static objects 2023-05-17 11:35:39 +02:00
LICENSES
mm mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() 2023-04-20 12:07:35 +02:00
net SUNRPC: remove the maximum number of retries in call_bind_status 2023-05-17 11:35:52 +02:00
samples
scripts scripts/gdb: bail early if there are no generic PD 2023-05-17 11:35:48 +02:00
security selinux: ensure av_permissions.h is built when needed 2023-05-17 11:35:34 +02:00
sound ASoC: es8316: Handle optional IRQ assignment 2023-05-17 11:35:46 +02:00
tools bpftool: Fix bug for long instructions in program CFG dumps 2023-05-17 11:35:42 +02:00
usr
virt KVM: Destroy target device if coalesced MMIO unregistration fails 2023-03-11 16:44:01 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.242 2023-04-26 11:24:06 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.