From nobody Sun Feb 8 05:40:29 2026 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8879B1FF1C7 for ; Thu, 25 Dec 2025 13:03:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766667830; cv=none; b=hXUsfKxIm9TdRFizUulywV/aQActRhkESA9jt5apPAVpcWtyz91U4v+3/v/BunwO/YjM4BKtL1k8ZzlJGywErjF/m4PKGbOKYb3fzXTdq3YCdTLGGIILsKoCCti5EoOc1HzXPdX0ZejPnKnutPzR1M60E4hspN73syLwkOnVB1o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766667830; c=relaxed/simple; bh=+czeTOun7iQEDGEpJW4qqmZFAamwYDxIkiTe97QYJTo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rHLW2dIMpnFaRDKEM4oIOurpw9HnpYVqU+yxi20+G8Lv/kAQ2QmB2esWfy515B8T7iQ+an427aO6lGnaBowuhEiHgS2HXlljD6vm8dCh7S8J32ej00iAGpfkxUPrB7rb7CgR+2PRBh2hH0E76Y++NFL8CvEV0Z1sRWoUhXXRAOU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HHx0NeKw; arc=none smtp.client-ip=209.85.214.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HHx0NeKw" Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2a12ebe4b74so115996225ad.0 for ; Thu, 25 Dec 2025 05:03:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1766667828; x=1767272628; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=dE1QmB/7vK5etUZWCavLMADLFIR3KXAGPm1iedawkO4=; b=HHx0NeKw6bbPRJdyX8gKkHDzl0jmi8T0MQUzswjqSJ8IUl07f/YRgYoJDwAyF/qNyG lq2XBWfdMiYmY9eTZpT1b09aQW72eiA/LtLg8OmTgrsFx72wLKg+lGNPeSr+LPkDxGbE R7XsvIGE+/dY9H8LyXXymONjOARYw/nEXHlomj9rH1OpXoGsC3Z3z5F3vrjeuR+bbtBe o7H5fo/D+YjJSIfEf3Mnhnjucalac7C6F4CAsM3alb2QI7EM3cT0vaMjWXBTMfyFYd17 LHEZ2UC/sftXJvE1boqCqXxsh4HSO9XJT3z3lx50iIt/WkhQaVJeZH3KFqBJd1K3nmFK Mysg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1766667828; x=1767272628; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=dE1QmB/7vK5etUZWCavLMADLFIR3KXAGPm1iedawkO4=; b=xF41pzGlvv44jXmeQKlxhsCjKfQ2dW4nbVpq65k6V9n7pks+y+/MmMpAdSgWkCxjch Sl824BLzsTqKNYTvSmtwrn/liMgqSYreY8+GV0JIwEo5tdrkL/arlie5MYgYH0OU8K8C epjv/RNXZfh6v/yTB84BLJ43axxQkIZzxwak6/AvbcxsEhe80d5eaugxCfs2DSwyvuzL 5DFotubwH1YpDbG0folMxaEYa8za3IFyvJh0iLMrsfnLb8SZaR+ZUh+Iyc+w3NSavcYn Q5XY4Yd5E1biEt6AFfLhVDJY6djFc7Jhzpeayo/yJFLpFJJyv0p+qudpWoXaz6gO76Q7 vQ3A== X-Forwarded-Encrypted: i=1; AJvYcCVViqEUFDqXFOEsHJ31/53nUywdlYlArKt7DMtAYP/ftDo8aosQ0FUtCbuhLWa1gqR8PS9JmiTWJDTpcIM=@vger.kernel.org X-Gm-Message-State: AOJu0YwKomcXcdVg2yIYqIbPIS4tXypw0i70f4OwkBqk+oR9RHnDNIrb rWiaMM2b9UwWoNq5kSwMIui5RqCqG+jyI+3b72KwcVB/xfw/RZ5Abl75 X-Gm-Gg: AY/fxX6bogJOtm0SV+vur055fn6k0q91d8Hugu1+1BJxMqoYOGAf2PmmXQHqu8HE2Bv HYrPQnf24HjdSf0MXH9Pag3Z8MGFn8JuBFJTVMrXEcUuibRGWGgEVQKCadvi+gRrhZjS66gAxcr cqJuUn9Lt2AzWXlVLVf1/mZLoJfG0Cyo+YzHSJ/xasN6j/a+X4hLzSTIwU7aJxuZGVSZfiyHOKr pMycW731x0E5P1lLc/BmhAUgETwa3wMIp7dVLHQamvuPoprEIYBb5BwCqXRBBgzBr8TP0ru2Zh8 X8mmrtkKNccD7kv9WH6AWxgHrsZH0F9unmK6mf52jvX16yQVQYnHTUzfhhPYPpau/+Liq+wBrCO NHgqxgCyecMsHuK9oClWGsQ1qwUAr4hgjU+NWreO6ZtNmiSIjxVqlcE0u9Kf1iHvUeBFw5wI= X-Google-Smtp-Source: AGHT+IEM8e7gCvZ2eJ9plaJ+SRNbIBkS1Z/NxtAnb4n/cd42BdmjA/o0GCtzg3gIcJl0/mjg4HnPMg== X-Received: by 2002:a17:902:db11:b0:2a1:deb:c46c with SMTP id d9443c01a7336-2a2f29361e9mr181431815ad.44.1766667827705; Thu, 25 Dec 2025 05:03:47 -0800 (PST) Received: from oslab.. ([2402:f000:4:1006:809:0:a77:18ea]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-7ff7e48cd07sm19422906b3a.46.2025.12.25.05.03.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Dec 2025 05:03:47 -0800 (PST) From: Tuo Li To: song@kernel.org, yukuai@fnnas.com Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, Tuo Li Subject: [PATCH v2] md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() Date: Thu, 25 Dec 2025 21:03:26 +0800 Message-ID: <20251225130326.67780-1-islituo@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The variable mddev->private is first assigned to conf and then checked: conf =3D mddev->private; if (!conf) ... If conf is NULL, then mddev->private is also NULL. In this case, null-pointer dereferences can occur when calling raid5_quiesce(): raid5_quiesce(mddev, true); raid5_quiesce(mddev, false); since mddev->private is assigned to conf again in raid5_quiesce(), and conf is dereferenced in several places, for example: conf->quiesce =3D 0; wake_up(&conf->wait_for_quiescent); To fix this issue, the function should unlock mddev and return before invoking raid5_quiesce() when conf is NULL, following the existing pattern in raid5_change_consistency_policy(). Fixes: fa1944bbe622 ("md/raid5: Wait sync io to finish before changing grou= p cnt") Signed-off-by: Tuo Li Reviewed-by: Paul Menzel Reviewed-by: Xiao Ni --- v2: * Move the NULL check and early return ahead of the first call to raid5_quiesce(). Thanks to Yu Kuai for helpful advice. --- drivers/md/raid5.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index e57ce3295292..8dc98f545969 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7187,12 +7187,14 @@ raid5_store_group_thread_cnt(struct mddev *mddev, c= onst char *page, size_t len) err =3D mddev_suspend_and_lock(mddev); if (err) return err; + conf =3D mddev->private; + if (!conf) { + mddev_unlock_and_resume(mddev); + return -ENODEV; + } raid5_quiesce(mddev, true); =20 - conf =3D mddev->private; - if (!conf) - err =3D -ENODEV; - else if (new !=3D conf->worker_cnt_per_group) { + if (new !=3D conf->worker_cnt_per_group) { old_groups =3D conf->worker_groups; if (old_groups) flush_workqueue(raid5_wq); --=20 2.43.0