[PATCH] drbd: fix null-pointer dereference on local read error

[PATCH] drbd: fix null-pointer dereference on local read error

[Christoph Böhmwalder]

In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to
__req_mod() with a NULL peer_device:

  __req_mod(req, what, NULL, &m);

The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this
NULL peer_device to drbd_set_out_of_sync(), which dereferences it,
causing a null-pointer dereference.

Fix this by obtaining the peer_device via first_peer_device(device),
matching how drbd_req_destroy() handles the same situation.

Cc: stable@vger.kernel.org
Reported-by: Tuo Li <islituo@gmail.com>
Link: https://lore.kernel.org/linux-block/20260104165355.151864-1-islituo@gmail.com
Signed-off-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
---
 drivers/block/drbd/drbd_req.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index d15826f6ee81..70f75ef07945 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -621,7 +621,8 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what,
 		break;
 
 	case READ_COMPLETED_WITH_ERROR:
-		drbd_set_out_of_sync(peer_device, req->i.sector, req->i.size);
+		drbd_set_out_of_sync(first_peer_device(device),
+				req->i.sector, req->i.size);
 		drbd_report_io_error(device, req);
 		__drbd_chk_io_error(device, DRBD_READ_ERROR);
 		fallthrough;

base-commit: 72f4d6fca699a1e35b39c5e5dacac2926d254135
-- 
2.53.0

Re: [PATCH] drbd: fix null-pointer dereference on local read error

[Jens Axboe]

On Fri, 20 Feb 2026 12:39:37 +0100, Christoph Böhmwalder wrote:
> In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to
> __req_mod() with a NULL peer_device:
> 
>   __req_mod(req, what, NULL, &m);
> 
> The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this
> NULL peer_device to drbd_set_out_of_sync(), which dereferences it,
> causing a null-pointer dereference.
> 
> [...]

Applied, thanks!

[1/1] drbd: fix null-pointer dereference on local read error
      commit: 0d195d3b205ca90db30d70d09d7bb6909aac178f

Best regards,
-- 
Jens Axboe