On Fri, Nov 6, 2020 at 2:21 PM Kevin Vigor <kvigor@xxxxxxxxx> wrote:
>
> In __make_request() a new r10bio is allocated and passed to
> raid10_read_request(). The read_slot member of the bio is not
> initialized, and the raid10_read_request() uses it to index an
> array. This leads to occasional panics.
>
> Fix by initializing the field to invalid value and checking for
> valid value in raid10_read_request().
>
> Signed-off-by: Kevin Vigor <kvigor@xxxxxxxxx>
> ---
> v2:
> - rebase onto md-next
> ---
> drivers/md/raid10.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
> index b7bca6703df8..3153183b7772 100644
> --- a/drivers/md/raid10.c
> +++ b/drivers/md/raid10.c
> @@ -1127,7 +1127,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio,
> struct md_rdev *err_rdev = NULL;
> gfp_t gfp = GFP_NOIO;
>
> - if (r10_bio->devs[slot].rdev) {
> + if (slot >= 0 && r10_bio->devs[slot].rdev) {
How about we initialize read_slot to 0, and get rid of this check?
Thanks,
Song
