md/raid5: setup_conf: Fix null-ptr-def in error handling path

[PATCH] md/raid5: setup_conf: Fix null-ptr-def in error handling path

Posted by Zhihao Cheng 1 week, 2 days ago

For raid5 setup_conf, if an error(eg. bioset_init fails) happens before
'conf->mddev = mddev', following error handling path could trigger a
null-ptr-def problem:

 free_conf
  log_exit
   raid5_has_ppl
    test_bit(MD_HAS_PPL, &conf->mddev->flags) // conf->mddev is NULL !

Fix it by initializing conf->mddev in advance.

Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
---
 drivers/md/raid5.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b91545ce090d..c091bba95c31 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7675,6 +7675,7 @@ static struct r5conf *setup_conf(struct mddev *mddev)
 	if (conf == NULL)
 		goto abort;
 
+	conf->mddev = mddev;
 #if PAGE_SIZE != DEFAULT_STRIPE_SIZE
 	conf->stripe_size = DEFAULT_STRIPE_SIZE;
 	conf->stripe_shift = ilog2(DEFAULT_STRIPE_SIZE) - 9;
@@ -7743,7 +7744,6 @@ static struct r5conf *setup_conf(struct mddev *mddev)
 	ret = bioset_init(&conf->bio_split, BIO_POOL_SIZE, 0, 0);
 	if (ret)
 		goto abort;
-	conf->mddev = mddev;
 
 	ret = -ENOMEM;
 	conf->stripe_hashtbl = kzalloc(PAGE_SIZE, GFP_KERNEL);
-- 
2.52.0

Re: [PATCH] md/raid5: setup_conf: Fix null-ptr-def in error handling path

Posted by yu kuai 1 week, 1 day ago

在 2026/9/15 16:17, Zhihao Cheng 写道:

> For raid5 setup_conf, if an error(eg. bioset_init fails) happens before
> 'conf->mddev = mddev', following error handling path could trigger a
> null-ptr-def problem:
>
>   free_conf
>    log_exit
>     raid5_has_ppl
>      test_bit(MD_HAS_PPL, &conf->mddev->flags) // conf->mddev is NULL !
>
> Fix it by initializing conf->mddev in advance.
>
> Fixes: 3418d036c81d ("raid5-ppl: Partial Parity Log write logging implementation")
> Signed-off-by: Zhihao Cheng<chengzhihao1@huawei.com>
> ---
>   drivers/md/raid5.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
Applied to md-7.4

-- 
Thanks,
Kuai