Patch "md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-raid10-fix-null-ptr-deref-of-mreplace-in-raid10_s.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fda1ddfab9ef411f328d9379813926289b6f5082
Author: Li Nan <linan122@xxxxxxxxxx>
Date:   Sat May 27 15:22:15 2023 +0800

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
    
    [ Upstream commit 34817a2441747b48e444cb0e05d84e14bc9443da ]
    
    There are two check of 'mreplace' in raid10_sync_request(). In the first
    check, 'need_replace' will be set and 'mreplace' will be used later if
    no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be
    set to NULL if it is Faulty, but 'need_replace' will not be changed
    accordingly. null-ptr-deref occurs if Faulty is set between two check.
    
    Fix it by merging two checks into one. And replace 'need_replace' with
    'mreplace' because their values are always the same.
    
    Fixes: ee37d7314a32 ("md/raid10: Fix raid10 replace hang when new added disk faulty")
    Signed-off-by: Li Nan <linan122@xxxxxxxxxx>
    Reviewed-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230527072218.2365857-2-linan666@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1f5589c5294dc..d3f8156da44e5 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3412,7 +3412,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
 			int must_sync;
 			int any_working;
 			int need_recover = 0;
-			int need_replace = 0;
 			struct raid10_info *mirror = &conf->mirrors[i];
 			struct md_rdev *mrdev, *mreplace;
 
@@ -3424,11 +3423,10 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
 			    !test_bit(Faulty, &mrdev->flags) &&
 			    !test_bit(In_sync, &mrdev->flags))
 				need_recover = 1;
-			if (mreplace != NULL &&
-			    !test_bit(Faulty, &mreplace->flags))
-				need_replace = 1;
+			if (mreplace && test_bit(Faulty, &mreplace->flags))
+				mreplace = NULL;
 
-			if (!need_recover && !need_replace) {
+			if (!need_recover && !mreplace) {
 				rcu_read_unlock();
 				continue;
 			}
@@ -3444,8 +3442,6 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
 				rcu_read_unlock();
 				continue;
 			}
-			if (mreplace && test_bit(Faulty, &mreplace->flags))
-				mreplace = NULL;
 			/* Unless we are doing a full sync, or a replacement
 			 * we only need to recover the block if it is set in
 			 * the bitmap
@@ -3568,11 +3564,11 @@ static sector_t raid10_sync_request(struct mddev *mddev, sector_t sector_nr,
 				bio = r10_bio->devs[1].repl_bio;
 				if (bio)
 					bio->bi_end_io = NULL;
-				/* Note: if need_replace, then bio
+				/* Note: if replace is not NULL, then bio
 				 * cannot be NULL as r10buf_pool_alloc will
 				 * have allocated it.
 				 */
-				if (!need_replace)
+				if (!mreplace)
 					break;
 				bio->bi_next = biolist;
 				biolist = bio;