releases/4.19.46/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch

   1 From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001
   2 From: Yufen Yu <yuyufen@huawei.com>
   3 Date: Tue, 2 Apr 2019 14:22:14 +0800
   4 Subject: md: add mddev->pers to avoid potential NULL pointer dereference
   5
   6 From: Yufen Yu <yuyufen@huawei.com>
   7
   8 commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.
   9
  10 When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
  11 which can avoid potential NULL pointer derefence in fallowing
  12 add_bound_rdev().
  13
  14 Fixes: a6da4ef85cef ("md: re-add a failed disk")
  15 Cc: Xiao Ni <xni@redhat.com>
  16 Cc: NeilBrown <neilb@suse.com>
  17 Cc: <stable@vger.kernel.org> # 4.4+
  18 Reviewed-by: NeilBrown <neilb@suse.com>
  19 Signed-off-by: Yufen Yu <yuyufen@huawei.com>
  20 Signed-off-by: Song Liu <songliubraving@fb.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22
  23 ---
  24  drivers/md/md.c |    6 ++++--
  25  1 file changed, 4 insertions(+), 2 deletions(-)
  26
  27 --- a/drivers/md/md.c
  28 +++ b/drivers/md/md.c
  29 @@ -2860,8 +2860,10 @@ state_store(struct md_rdev *rdev, const
  30                         err = 0;
  31                 }
  32         } else if (cmd_match(buf, "re-add")) {
  33 -               if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
  34 -                       rdev->saved_raid_disk >= 0) {
  35 +               if (!rdev->mddev->pers)
  36 +                       err = -EINVAL;
  37 +               else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
  38 +                               rdev->saved_raid_disk >= 0) {
  39                         /* clear_bit is performed _after_ all the devices
  40                          * have their local Faulty bit cleared. If any writes
  41                          * happen in the meantime in the local node, they