[PATCH 3/3] md/raid10: Don't free conf on raid10_run failure
flat view
COLD36d
From: Zhihao Cheng <chengzhihao1@huawei.com>
Date: 2026-09-21 07:23:51
Also in:
lkml
Subsystem:
software raid (multiple disks) support, the rest · Maintainers:
Song Liu, Yu Kuai, Linus Torvalds
Set 'raid_disks' after raid5_run() failure will trigger an
null-ptr-deref problem:
BUG: kernel NULL pointer dereference, address: 00000000000000dc
RIP: 0010:_raw_spin_lock_irq+0x3d
Call Trace:
raise_barrier+0x3a
raid10_quiesce+0x20
__md_stop_writes+0x6c
do_md_stop+0xaa
The trigger process is simple:
mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/sda /dev/sdb
--force --assume-clean # create raid0
echo 10 > /sys/block/md0/md/level
level_store
mddev->pers = pers
mddev->private = priv
raid10_run
fail to out_free_conf (eg. enough fails)
raid10_free_conf(conf)
mddev->private = NULL
echo inactive > /sys/block/md0/md/array_state
array_state_store
do_md_stop
__md_stop_writes
raid10_quiesce
raise_barrier
write_seqlock_irq(&conf->resync_lock) // null-ptr-deref !
Just like commit 35f20acaa358 ("md/raid0: don't free conf on raid0_run
failure") does, fix it by not free conf on raid10_run failure.
Fixes: 245f46c2c221e ("md: add ->takeover method to support changing the personality managing an array")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
---
drivers/md/raid10.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1093c798d9dd..9e4d4202f35c 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c@@ -3972,7 +3972,7 @@ static int raid10_run(struct mddev *mddev) if (fc > 1 || fo > 0) { pr_err("only near layout is supported by clustered" " raid10\n"); - goto out_free_conf; + goto out_unregister_thread; } }
@@ -3989,11 +3989,11 @@ static int raid10_run(struct mddev *mddev) if (test_bit(Replacement, &rdev->flags)) { if (disk->replacement) - goto out_free_conf; + goto out_unregister_thread; disk->replacement = rdev; } else { if (disk->rdev) - goto out_free_conf; + goto out_unregister_thread; disk->rdev = rdev; } diff = (rdev->new_data_offset - rdev->data_offset);
@@ -4013,7 +4013,7 @@ static int raid10_run(struct mddev *mddev) if (err) { ret = err; - goto out_free_conf; + goto out_unregister_thread; } }
@@ -4021,17 +4021,17 @@ static int raid10_run(struct mddev *mddev) if (!enough(conf, -1)) { pr_err("md/raid10:%s: not enough operational mirrors.\n", mdname(mddev)); - goto out_free_conf; + goto out_unregister_thread; } if (conf->reshape_progress != MaxSector) { /* must ensure that shape change is supported */ if (conf->geo.far_copies != 1 && conf->geo.far_offset == 0) - goto out_free_conf; + goto out_unregister_thread; if (conf->prev.far_copies != 1 && conf->prev.far_offset == 0) - goto out_free_conf; + goto out_unregister_thread; } mddev->degraded = 0;
@@ -4081,7 +4081,7 @@ static int raid10_run(struct mddev *mddev) set_bit(MD_FAILFAST_SUPPORTED, &mddev->flags); if (md_integrity_register(mddev)) - goto out_free_conf; + goto out_unregister_thread; if (conf->reshape_progress != MaxSector) { unsigned long before_length, after_length;
@@ -4094,7 +4094,7 @@ static int raid10_run(struct mddev *mddev) if (max(before_length, after_length) > min_offset_diff) { /* This cannot work */ pr_warn("md/raid10: offset difference not enough to continue reshape\n"); - goto out_free_conf; + goto out_unregister_thread; } conf->offset_diff = min_offset_diff;
@@ -4106,10 +4106,8 @@ static int raid10_run(struct mddev *mddev) return 0; -out_free_conf: +out_unregister_thread: md_unregister_thread(mddev, &mddev->thread); - raid10_free_conf(conf); - mddev->private = NULL; out: return ret; }
--
2.52.0