From: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
To: NeilBrown <neilb@suse.com>, Shaohua Li <shli@kernel.org>
Cc: linux-raid@vger.kernel.org, yuyufen <yuyufen@huawei.com>, colyli@suse.de
Subject: Re: [md PATCH 2/2] md: only allow remove_and_add_spares when no sync_thread running.
Date: Tue, 6 Feb 2018 15:50:30 +0100 [thread overview]
Message-ID: <f851bbe8-7f69-8c5f-1fe2-17abdf251b60@intel.com> (raw)
In-Reply-To: <151760997028.5944.10292479373004611829.stgit@noble>
On 02/02/2018 11:19 PM, NeilBrown wrote:
> The locking protocols in md assume that a device will
> never be removed from an array during resync/recovery/reshape.
> When that isn't happening, rcu or reconfig_mutex is needed
> to protect an rdev pointer while taking a refcount. When
> it is happening, that protection isn't needed.
>
> Unfortunately there are cases were remove_and_add_spares() is
> called when recovery might be happening: is state_store(),
> slot_store() and hot_remove_disk().
> In each case, this is just an optimization, to try to expedite
> removal from the personality so the device can be removed from
> the array. If resync etc is happening, we just have to wait
> for md_check_recover to find a suitable time to call
> remove_and_add_spares().
>
> This optimization and not essential so it doesn't
> matter if it fails.
> So change remove_and_add_spares() to abort early if
> resync/recovery/reshape is happening, unless it is called
> from md_check_recovery() as part of a newly started recovery.
> The parameter "this" is only NULL when called from
> md_check_recovery() so when it is NULL, there is no need to abort.
>
> As this can result in a NULL dereference, the fix is suitable
> for -stable.
>
> cc: yuyufen <yuyufen@huawei.com>
> Cc: Tomasz Majchrzak <tomasz.majchrzak@intel.com>
> Fixes: 8430e7e0af9a ("md: disconnect device from personality before trying to remove it.")
> Cc: stable@ver.kernel.org (v4.8+)
> Signed-off-by: NeilBrown <neilb@suse.com>
I can confirm that this patch fixes a NULL pointer dereference issue for me.
Tested-by: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
next prev parent reply other threads:[~2018-02-06 14:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-02 22:19 [md PATCH 0/2] Resend raid10-NULL-deref fix NeilBrown
2018-02-02 22:19 ` [md PATCH 2/2] md: only allow remove_and_add_spares when no sync_thread running NeilBrown
2018-02-06 14:50 ` Artur Paszkiewicz [this message]
2018-02-02 22:19 ` [md PATCH 1/2] md: document lifetime of internal rdev pointer NeilBrown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f851bbe8-7f69-8c5f-1fe2-17abdf251b60@intel.com \
--to=artur.paszkiewicz@intel.com \
--cc=colyli@suse.de \
--cc=linux-raid@vger.kernel.org \
--cc=neilb@suse.com \
--cc=shli@kernel.org \
--cc=yuyufen@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox