]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
md/raid0: fix NULL pointer dereference in create_strip_zones() for dm-raid
authorYu Kuai <yukuai@fnnas.com>
Sun, 16 Nov 2025 02:18:16 +0000 (10:18 +0800)
committerYu Kuai <yukuai@fnnas.com>
Sun, 30 Nov 2025 01:36:50 +0000 (09:36 +0800)
Commit 2107457e31fa ("md/raid0: Move queue limit setup before r0conf
initialization") dereference mddev->gendisk unconditionally, which is
NULL for dm-raid.

Fix this problem by reverting to old codes for dm-raid.

Link: https://lore.kernel.org/linux-raid/20251116021816.107648-1-yukuai@fnnas.com
Fixes: 2107457e31fa ("md/raid0: Move queue limit setup before r0conf initialization")
Reported-and-tested-by: Changhui Zhong <czhong@redhat.com>
Closes: https://lore.kernel.org/all/CAGVVp+VqVnvGeneUoTbYvBv2cw6GwQRrR3B-iQ-_9rVfyumoKA@mail.gmail.com/
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Li Nan <linan122@huawei.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
drivers/md/raid0.c

index 47aee1b1d4d17995577e9f71a2484e00e8542331..985c377356ebd27b22197a22fff2157252282239 100644 (file)
@@ -68,7 +68,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
        struct strip_zone *zone;
        int cnt;
        struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
-       unsigned int blksize = queue_logical_block_size(mddev->gendisk->queue);
+       unsigned int blksize = 512;
+
+       if (!mddev_is_dm(mddev))
+               blksize = queue_logical_block_size(mddev->gendisk->queue);
 
        *private_conf = ERR_PTR(-ENOMEM);
        if (!conf)
@@ -84,6 +87,10 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
                sector_div(sectors, mddev->chunk_sectors);
                rdev1->sectors = sectors * mddev->chunk_sectors;
 
+               if (mddev_is_dm(mddev))
+                       blksize = max(blksize, queue_logical_block_size(
+                                     rdev1->bdev->bd_disk->queue));
+
                rdev_for_each(rdev2, mddev) {
                        pr_debug("md/raid0:%s:   comparing %pg(%llu)"
                                 " with %pg(%llu)\n",