Re: [PATCH v2 1/4] md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

Yu Kuai <yukuai1@xxxxxxxxxxxxxxx> · Sat, 27 May 2023 09:17:45 +0800

Hi,

在 2023/05/27 5:38, Song Liu 写道:
On Fri, May 26, 2023 at 12:47 AM <linan666@xxxxxxxxxxxxxxx> wrote:                    }

To make sure I understand the issue correctly:

The null-ptr-deref only happens when the Faulty bit was set after the
last check and before this check below, right?

Yes, you're right.

Thanks,
Kuai

-                       if (mreplace && test_bit(Faulty, &mreplace->flags))
-                               mreplace = NULL;
                         /* Unless we are doing a full sync, or a replacement
                          * we only need to recover the block if it is set in
                          * the bitmap

Thanks,
Song