diff options
| author | Philipp Reisner <philipp.reisner@linbit.com> | 2012-10-19 14:19:23 +0200 |
|---|---|---|
| committer | Philipp Reisner <philipp.reisner@linbit.com> | 2012-11-09 14:11:42 +0100 |
| commit | fd0017c1243b2b9058525672b9ea13272fb51b30 (patch) | |
| tree | 529e6eaef73f2ac210e12f9bc4eb8a6178e1894c | |
| parent | 4035e4c2ebeb6ac1acbf4e5dd8a759fcf93ff8da (diff) | |
| download | linux-3.10-fd0017c1243b2b9058525672b9ea13272fb51b30.tar.gz linux-3.10-fd0017c1243b2b9058525672b9ea13272fb51b30.tar.bz2 linux-3.10-fd0017c1243b2b9058525672b9ea13272fb51b30.zip | |
drbd: fix regression: potential NULL pointer dereference
recent commit
drbd: always write bitmap on detach
introduced a bitmap writeout during detach,
which obviously needs some meta data device to write to.
Unfortunately, that same error path may be taken if we fail to attach,
e.g. due to UUID mismatch, after we changed state to D_ATTACHING,
but before the lower level device pointer is even assigned.
We need to test for presence of mdev->ldev.
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
| -rw-r--r-- | drivers/block/drbd/drbd_int.h | 5 | ||||
| -rw-r--r-- | drivers/block/drbd/drbd_main.c | 8 |
2 files changed, 11 insertions, 2 deletions
diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h index 32a9ab67a5f..057ffed6eb7 100644 --- a/drivers/block/drbd/drbd_int.h +++ b/drivers/block/drbd/drbd_int.h @@ -2318,6 +2318,11 @@ static inline void drbd_md_flush(struct drbd_conf *mdev) { int r; + if (mdev->ldev == NULL) { + dev_warn(DEV, "mdev->ldev == NULL in drbd_md_flush\n"); + return; + } + if (test_bit(MD_NO_FUA, &mdev->flags)) return; diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c index 0f73e157dee..be4f5827712 100644 --- a/drivers/block/drbd/drbd_main.c +++ b/drivers/block/drbd/drbd_main.c @@ -3235,8 +3235,12 @@ static int w_go_diskless(struct drbd_work *w, int unused) * (Do we want a specific meta data flag for this?) * * If that does not make it to stable storage either, - * we cannot do anything about that anymore. */ - if (mdev->bitmap) { + * we cannot do anything about that anymore. + * + * We still need to check if both bitmap and ldev are present, we may + * end up here after a failed attach, before ldev was even assigned. + */ + if (mdev->bitmap && mdev->ldev) { if (drbd_bitmap_io_from_worker(mdev, drbd_bm_write, "detach", BM_LOCKED_MASK)) { if (test_bit(WAS_READ_ERROR, &mdev->flags)) { |