]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
drbd: fix null-pointer dereference on local read error
authorChristoph Böhmwalder <christoph.boehmwalder@linbit.com>
Fri, 20 Feb 2026 11:39:37 +0000 (12:39 +0100)
committerJens Axboe <axboe@kernel.dk>
Fri, 20 Feb 2026 14:09:06 +0000 (07:09 -0700)
commit0d195d3b205ca90db30d70d09d7bb6909aac178f
treed8a20853616109159fcd2525f474675446c39722
parent81b1f046ff8a5ad5da2c970cff354b61dfa1d6b1
drbd: fix null-pointer dereference on local read error

In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to
__req_mod() with a NULL peer_device:

  __req_mod(req, what, NULL, &m);

The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this
NULL peer_device to drbd_set_out_of_sync(), which dereferences it,
causing a null-pointer dereference.

Fix this by obtaining the peer_device via first_peer_device(device),
matching how drbd_req_destroy() handles the same situation.

Cc: stable@vger.kernel.org
Reported-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/linux-block/20260104165355.151864-1-islituo@gmail.com
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
drivers/block/drbd/drbd_req.c