From nobody Sun Apr 5 13:05:59 2026 Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 981422D8375 for ; Fri, 20 Feb 2026 11:39:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.54 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771587588; cv=none; b=olqDECNU6lb1vhoPn1AemFSAZ6rrjDL6NoMWioDsLsyASPjfOcBz5MdETs/BRNvua5z+4IpaXV9CUClYHJWfn9CflsZ4UWMfaPh2lG304jqXLc+sOdqMQg7RTnMrtqOqMzYGigl6ALWQA7oYhgMWpQD1vR8iJfSxu6RgajBGFhc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771587588; c=relaxed/simple; bh=09UEbk9dCc1/v7GTUjrY4SUM9KDAOWfH15C+AzLS2AM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=MEBRPJtwtOr1t4Joc0DKylnFraufyEOcVPAQY8f6u68N/+oVy5aWfIDczrF457vvSkO9heIGmAHCZlIIZf0bMRNIQumU8Y93BqxzkTfPjtnCpiu5ZSfYF2qV5Cs/E2kBstsnLNt1EMcrQyt+7Cma8npOO1sEUznM6Ngl+lreJtY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linbit.com; spf=pass smtp.mailfrom=linbit.com; dkim=pass (2048-bit key) header.d=linbit-com.20230601.gappssmtp.com header.i=@linbit-com.20230601.gappssmtp.com header.b=Mh8hHb79; arc=none smtp.client-ip=209.85.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linbit.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linbit.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linbit-com.20230601.gappssmtp.com header.i=@linbit-com.20230601.gappssmtp.com header.b="Mh8hHb79" Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-482f454be5bso28269685e9.0 for ; Fri, 20 Feb 2026 03:39:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linbit-com.20230601.gappssmtp.com; s=20230601; t=1771587584; x=1772192384; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=NAZvmYa4+oLnoaGzT3J4OlkyuUdxp/o/vWFvPoP3fG0=; b=Mh8hHb794dTdhWTQo28a964za56bBpuZ9D4oliBPpVgnd1Yrs2rgIgfwZHn/yNRvQg EF7iJyFR3nf0tOVrBT7Gy89mRTAfnZgwUIxjWn1CXc6tVjwMzrU4hQ9W7JpZXZTRAOY4 gu+nivpZ87n3oKx/u8rhnpLqXjOfUBgD25tMcp0FrnmYosm+N4rhzLDdrk6d3mzOFkfz UBbUWfb7Grs+oHCZuQy43E8JtOizYc3030pIbWR0dw2TyoTq+Om3XALDBTZW9zQBEZM7 YlsheWQLhIdJZKU7Eq22Wb/2XJvXPTf9TNq5TPgWQxLSvNnEQus7YE9ByolRRLZt0ViU c5ng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771587584; x=1772192384; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=NAZvmYa4+oLnoaGzT3J4OlkyuUdxp/o/vWFvPoP3fG0=; b=w5Ix3Njnlj3x1SK6Ond01a+TbNzVWTkBxatMGZp5wsyrHwmELH/994q4TDKk9hRq+X S+JHrUffE6tZWGeqcsFyyjbHl6ZROXDBuXZzcmYT0Nblh3+fzWz5/Fv0RybBbRjuyJIi IrsVXr+ykzhaYssO8r69PknqUPcTkjs9vs3PVxpPEIF1dwt88nt/Op5JvHvPdl4r0eWJ lezttCh2AcEL1lHJXi8G+NHlL+GO0GhNkshC1kCfMMXp8jwEZ6bJJxViB3ffAfVKHWuo f/DKoLynPW19V052sjijtAxHYcaylYQY3DlbuJVCoLiEdP8VyShIAZqLPG0gLmv3lmVe pgYA== X-Forwarded-Encrypted: i=1; AJvYcCXiOm8gpHlvmzJ8SMfn80ON1b0GQc7SuS7w7YBycKDF5PYy+S41o9es5geFQTSIGk7aRLjDkF1rljw+anE=@vger.kernel.org X-Gm-Message-State: AOJu0Yy28jVtqk1eYOP2wVFc2eYXy8O4xOgcNGOzG+7CbCt4EurIVpAU 1x6OFUyD1Y9X+weYCkhQqM89dUoqvPrqAhuyvJG1vrTvsmdsq+MyAFRuFyhB9wRUG1o= X-Gm-Gg: AZuq6aKV2Qwz5JgLrOjUYIdk99WT5vvZcDYRDUEAf5zKamk3EHmvgFl11Nf/ffG8qRq LirfSudh0wq4Q28qOo+l6RC4EHjpQULbYv7K0ELdNTYAs5enuRt5YkH11zvxjHM78F78kFiGvSN bO5k+HQeWoTXO63e2NDpHS4St8Xxea3ydKmzfDIOyMA79QTfoWFg755Clu35H32P2qBssqV8JA8 Uy38iOxWWlCvC2Dirwqz6rLpfqFgaGegTVyoiQy1hf7XfO8Nl7LwIvEO9FtG9e7kd27Hfx8tTtK HzYtGH6hECcjv2DSYues1aVNvlbKdNUCiOp+e134sglU/RABomXfxZvi6RqjPNgjSyv2gUryq5q 4cLkhDRvz5BfOLSdlNI9pwaACEpsYCIXIcaeOJ2/BcwaDO4Gk2GW1R2Jg7QCEpfDAfw/2b+87wf m1BcI39AFx6IkgtB1X8+r2ktV3DNjxi7XK7oArGYSCRgjpCixgTmv8kEk92Gs5xhOX5BvGgCG9k hINsIHbaJhgTOc380TWRA== X-Received: by 2002:a05:600c:c114:b0:47e:e97e:11aa with SMTP id 5b1f17b1804b1-4839fe8e843mr76621565e9.4.1771587583811; Fri, 20 Feb 2026 03:39:43 -0800 (PST) Received: from localhost.localdomain (h082218028181.host.wavenet.at. [82.218.28.181]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-483a316eb08sm75529045e9.0.2026.02.20.03.39.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 20 Feb 2026 03:39:43 -0800 (PST) From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= To: Jens Axboe Cc: drbd-dev@lists.linbit.com, linux-kernel@vger.kernel.org, Lars Ellenberg , Philipp Reisner , linux-block@vger.kernel.org, =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= , stable@vger.kernel.org, Tuo Li Subject: [PATCH] drbd: fix null-pointer dereference on local read error Date: Fri, 20 Feb 2026 12:39:37 +0100 Message-ID: <20260220113937.2691322-1-christoph.boehmwalder@linbit.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(), which dereferences it, causing a null-pointer dereference. Fix this by obtaining the peer_device via first_peer_device(device), matching how drbd_req_destroy() handles the same situation. Cc: stable@vger.kernel.org Reported-by: Tuo Li Link: https://lore.kernel.org/linux-block/20260104165355.151864-1-islituo@g= mail.com Signed-off-by: Christoph B=C3=B6hmwalder --- drivers/block/drbd/drbd_req.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c index d15826f6ee81..70f75ef07945 100644 --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -621,7 +621,8 @@ int __req_mod(struct drbd_request *req, enum drbd_req_e= vent what, break; =20 case READ_COMPLETED_WITH_ERROR: - drbd_set_out_of_sync(peer_device, req->i.sector, req->i.size); + drbd_set_out_of_sync(first_peer_device(device), + req->i.sector, req->i.size); drbd_report_io_error(device, req); __drbd_chk_io_error(device, DRBD_READ_ERROR); fallthrough; base-commit: 72f4d6fca699a1e35b39c5e5dacac2926d254135 --=20 2.53.0