From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mail19.linbit.com (LINBIT Mail Daemon) with ESMTP id A4E4E160922 for ; Fri, 20 Feb 2026 12:39:44 +0100 (CET) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4806bf39419so21875775e9.1 for ; Fri, 20 Feb 2026 03:39:44 -0800 (PST) From: =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= To: Jens Axboe Subject: [PATCH] drbd: fix null-pointer dereference on local read error Date: Fri, 20 Feb 2026 12:39:37 +0100 Message-ID: <20260220113937.2691322-1-christoph.boehmwalder@linbit.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Philipp Reisner , stable@vger.kernel.org, linux-kernel@vger.kernel.org, linux-block@vger.kernel.org, Lars Ellenberg , Tuo Li , drbd-dev@lists.linbit.com List-Id: "*Coordination* of development, patches, contributions -- *Questions* \(even to developers\) go to drbd-user, please." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(), which dereferences it, causing a null-pointer dereference. Fix this by obtaining the peer_device via first_peer_device(device), matching how drbd_req_destroy() handles the same situation. Cc: stable@vger.kernel.org Reported-by: Tuo Li Link: https://lore.kernel.org/linux-block/20260104165355.151864-1-islituo@gmail.com Signed-off-by: Christoph Böhmwalder --- drivers/block/drbd/drbd_req.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c index d15826f6ee81..70f75ef07945 100644 --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -621,7 +621,8 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what, break; case READ_COMPLETED_WITH_ERROR: - drbd_set_out_of_sync(peer_device, req->i.sector, req->i.size); + drbd_set_out_of_sync(first_peer_device(device), + req->i.sector, req->i.size); drbd_report_io_error(device, req); __drbd_chk_io_error(device, DRBD_READ_ERROR); fallthrough; base-commit: 72f4d6fca699a1e35b39c5e5dacac2926d254135 -- 2.53.0