releases/2.6.17.11/md-fix-a-potential-null-dereference-in-md-raid1.patch

   1 From stable-bounces@linux.kernel.org Sun Aug 20 17:06:06 2006
   2 From: NeilBrown <neilb@suse.de>
   3 To: Stable <stable@kernel.org>
   4 Date: Mon, 21 Aug 2006 10:05:26 +1000
   5 Message-Id: <1060821000526.22545@suse.de>
   6 Cc: linux-raid@vger.kernel.org
   7 Subject: MD: Fix a potential NULL dereference in md/raid1
   8
   9 From: NeilBrown <neilb@suse.de>
  10
  11 At the point where this 'atomic_add' is, rdev could be NULL, as seen by
  12 the fact that we test for this in the very next statement.
  13
  14 Further is it is really the wrong place of the add.  We could add to the
  15 count of corrected errors once the are sure it was corrected, not before
  16 trying to correct it.
  17
  18 Signed-off-by: Neil Brown <neilb@suse.de>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  20
  21
  22 diff .prev/drivers/md/raid1.c ./drivers/md/raid1.c
  23 ---
  24  drivers/md/raid1.c |    4 +++-
  25  1 file changed, 3 insertions(+), 1 deletion(-)
  26
  27 --- linux-2.6.17.9.orig/drivers/md/raid1.c
  28 +++ linux-2.6.17.9/drivers/md/raid1.c
  29 @@ -1486,7 +1486,6 @@ static void raid1d(mddev_t *mddev)
  30                                                         d = conf->raid_disks;
  31                                                 d--;
  32                                                 rdev = conf->mirrors[d].rdev;
  33 -                                               atomic_add(s, &rdev->corrected_errors);
  34                                                 if (rdev &&
  35                                                     test_bit(In_sync, &rdev->flags)) {
  36                                                         if (sync_page_io(rdev->bdev,
  37 @@ -1509,6 +1508,9 @@ static void raid1d(mddev_t *mddev)
  38                                                                          s<<9, conf->tmppage, READ) == 0)
  39                                                                 /* Well, this device is dead */
  40                                                                 md_error(mddev, rdev);
  41 +                                                       else
  42 +                                                               atomic_add(s, &rdev->corrected_errors);
  43 +
  44                                                 }
  45                                         }
  46                                 } else {