microsoft
/
WSL2-Linux-Kernel
зеркало из https://github.com/microsoft/WSL2-Linux-Kernel.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
WSL2-Linux-Kernel/drivers
История
Yufen Yu 879a73b10a md/raid1: fix NULL pointer dereference 
[ Upstream commit 3de59bb9d5 ]

In handle_write_finished(), if r1_bio->bios[m] != NULL, it thinks
the corresponding conf->mirrors[m].rdev is also not NULL. But, it
is not always true.

Even if some io hold replacement rdev(i.e. rdev->nr_pending.count > 0),
raid1_remove_disk() can also set the rdev as NULL. That means,
bios[m] != NULL, but mirrors[m].rdev is NULL, resulting in NULL
pointer dereference in handle_write_finished and sync_request_write.

This patch can fix BUGs as follows:

 BUG: unable to handle kernel NULL pointer dereference at 0000000000000140
 IP: [<ffffffff815bbbbd>] raid1d+0x2bd/0xfc0
 PGD 12ab52067 PUD 12f587067 PMD 0
 Oops: 0000 [#1] SMP
 CPU: 1 PID: 2008 Comm: md3_raid1 Not tainted 4.1.44+ #130
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
 Call Trace:
  ? schedule+0x37/0x90
  ? prepare_to_wait_event+0x83/0xf0
  md_thread+0x144/0x150
  ? wake_atomic_t_function+0x70/0x70
  ? md_start_sync+0xf0/0xf0
  kthread+0xd8/0xf0
  ? kthread_worker_fn+0x160/0x160
  ret_from_fork+0x42/0x70
  ? kthread_worker_fn+0x160/0x160

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b8
 IP: sync_request_write+0x9e/0x980
 PGD 800000007c518067 P4D 800000007c518067 PUD 8002b067 PMD 0
 Oops: 0000 [#1] SMP PTI
 CPU: 24 PID: 2549 Comm: md3_raid1 Not tainted 4.15.0+ #118
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014
 Call Trace:
  ? sched_clock+0x5/0x10
  ? sched_clock_cpu+0xc/0xb0
  ? flush_pending_writes+0x3a/0xd0
  ? pick_next_task_fair+0x4d5/0x5f0
  ? __switch_to+0xa2/0x430
  raid1d+0x65a/0x870
  ? find_pers+0x70/0x70
  ? find_pers+0x70/0x70
  ? md_thread+0x11c/0x160
  md_thread+0x11c/0x160
  ? finish_wait+0x80/0x80
  kthread+0x111/0x130
  ? kthread_create_worker_on_cpu+0x70/0x70
  ? do_syscall_64+0x6f/0x190
  ? SyS_exit_group+0x10/0x10
  ret_from_fork+0x35/0x40

Reviewed-by: NeilBrown <neilb@suse.com>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Shaohua Li <sh.li@alibaba-inc.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2018-05-30 07:52:03 +02:00
..
accessibility License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
acpi ACPI / button: make module loadable when booted in non-ACPI mode 2018-05-09 09:51:49 +02:00
amba ARM: amba: Don't read past the end of sysfs "driver_override" buffer 2018-05-01 12:58:21 -07:00
android ANDROID: binder: prevent transactions into own process. 2018-05-01 12:58:20 -07:00
ata libata: Fix compile warning with ATA_DEBUG enabled 2018-05-30 07:51:54 +02:00
atm atm: zatm: Fix potential Spectre v1 2018-05-16 10:10:29 +02:00
auxdisplay auxdisplay: img-ascii-lcd: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE 2018-02-07 11:12:20 -08:00
base x86/bugs: Expose /sys/../spec_store_bypass 2018-05-22 18:54:02 +02:00
bcma License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
block loop: fix LOOP_GET_STATUS lock imbalance 2018-05-25 16:17:35 +02:00
bluetooth Bluetooth: btusb: Add device ID for RTL8822BE 2018-05-25 16:17:42 +02:00
bus sunxi-rsb: Include OF based modalias in device uevent 2018-01-10 09:31:19 +01:00
cdrom cdrom: information leak in cdrom_ioctl_media_changed() 2018-04-29 11:33:16 +02:00
char virtio_console: reset on out of memory 2018-05-01 12:58:12 -07:00
clk clk: samsung: exynos3250: Fix PLL rates 2018-05-25 16:17:55 +02:00
clocksource clocksource/imx-tpm: Correct -ETIME return condition check 2018-04-26 11:02:02 +02:00
connector
…
cpufreq cpufreq: powernv: Fix hardlockup due to synchronous smp_call in timer interrupt 2018-05-01 12:58:24 -07:00
cpuidle cpuidle: fix broadcast control when broadcast can not be entered 2017-12-25 14:26:30 +01:00
crypto crypto: inside-secure - fix the invalidation step during cra_exit 2018-05-25 16:17:46 +02:00
dax dev/dax: fix uninitialized variable build warning 2017-12-20 10:10:34 +01:00
dca
…
devfreq PM / devfreq: Fix potential NULL pointer dereference in governor_store 2018-04-12 12:32:13 +02:00
dio License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dma dmaengine: at_xdmac: fix rare residue corruption 2018-04-24 09:36:32 +02:00
dma-buf dma-buf/fence: Fix lock inversion within dma-fence-array 2018-03-19 08:42:47 +01:00
edac x86/mce/AMD, EDAC/mce_amd: Enumerate Reserved SMCA bank type 2018-04-19 08:56:20 +02:00
eisa License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
extcon extcon: intel-cht-wc: Set direction and drv flags for V5 boost GPIO 2018-04-24 09:36:29 +02:00
firewire firewire-ohci: work around oversized DMA reads on JMicron controllers 2018-04-26 11:02:03 +02:00
firmware firmware: dmi_scan: Fix handling of empty DMI strings 2018-04-26 11:02:16 +02:00
fmc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fpga fpga-manager: altera-ps-spi: preserve nCONFIG state 2018-05-01 12:58:24 -07:00
fsi
…
gpio gpio: fix error path in lineevent_create 2018-05-16 10:10:26 +02:00
gpu drm/meson: fix vsync buffer update 2018-05-30 07:51:59 +02:00
hid HID: roccat: prevent an out of bounds read in kovaplus_profile_activated() 2018-04-26 11:02:10 +02:00
hsi License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hv Drivers: hv: vmbus: do not mark HV_PCIE as perf_device 2018-04-19 08:56:16 +02:00
hwmon hwmon: (ina2xx) Fix access to uninitialized mutex 2018-04-19 08:56:20 +02:00
hwspinlock License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hwtracing coresight: Fix disabling of CoreSight TPIU 2018-03-24 11:01:26 +01:00
i2c i2c: designware: fix poll-after-enable regression 2018-05-22 18:53:58 +02:00
ide ide: ide-atapi: fix compile error with defining macro DEBUG 2017-12-17 15:08:00 +01:00
idle Revert "x86/mm: Stop calling leave_mm() in idle code" 2017-11-04 15:01:50 +01:00
iio iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot() 2018-03-28 18:24:49 +02:00
infiniband RDMA/bnxt_re: Fix system crash during load/unload 2018-05-30 07:51:59 +02:00
input Input: atmel_mxt_ts - add touchpad button mapping for Samsung Chromebook Pro 2018-05-09 09:51:51 +02:00
iommu iommu/vt-d: Use domain instead of cache fetching 2018-04-26 11:02:06 +02:00
ipack
…
irqchip irqchip/qcom: Fix check for spurious interrupts 2018-05-09 09:51:56 +02:00
isdn License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
leds leds: pm8058: Silence pointer to integer size warning 2018-03-19 08:42:50 +01:00
lightnvm lightnvm: pblk: protect line bitmap while submitting meta io 2017-12-20 10:10:38 +01:00
macintosh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mailbox mailbox: mailbox-test: don't rely on rx_buffer content to signal data ready 2017-12-14 09:53:12 +01:00
mcb License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
md md/raid1: fix NULL pointer dereference 2018-05-30 07:52:03 +02:00
media media: cx25821: prevent out-of-bounds read on array card 2018-05-25 16:17:58 +02:00
memory License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
memstick License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
message scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo() 2018-05-25 16:17:47 +02:00
mfd mfd: twl6040: Fix child-node lookup 2017-12-29 17:53:46 +01:00
misc cxl: Fix possible deadlock when processing page faults from cxllib 2018-04-24 09:36:32 +02:00
mmc mmc: sdhci-iproc: add SDHCI_QUIRK2_HOST_OFF_CARD_ON for cygnus 2018-05-30 07:51:48 +02:00
mtd mtd: rawnand: tango: Fix struct clk memory leak 2018-05-01 12:58:19 -07:00
mux mux: core: fix double get_device() 2018-01-17 09:45:27 +01:00
net macvlan: fix use-after-free in macvlan_common_newlink() 2018-05-30 07:52:02 +02:00
nfc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ntb ntb_transport: Fix bug with max_mw_size parameter 2018-04-26 11:02:13 +02:00
nubus License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
nvdimm libnvdimm, namespace: use a safe lookup for dimm device name 2018-04-24 09:36:32 +02:00
nvme nvme: add quirk to force medium priority for SQ creation 2018-05-16 10:10:30 +02:00
nvmem License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
of earlycon: Use a pointer table to fix __earlycon_table stride 2018-05-01 12:58:24 -07:00
oprofile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
parisc parisc: Hide Diva-built-in serial aux and graphics card 2017-12-29 17:53:47 +01:00
parport parport_pc: Add support for WCH CH382L PCI-E single parallel port card. 2018-04-08 14:26:31 +02:00
pci PCI / PM: Check device_may_wakeup() in pci_enable_wake() 2018-05-16 10:10:29 +02:00
pcmcia License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
perf License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
phy phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS 2018-04-24 09:36:23 +02:00
pinctrl Revert "pinctrl: intel: Initialize GPIO properly when used through irqchip" 2018-04-29 11:33:09 +02:00
platform platform/x86: asus-wireless: Fix NULL pointer dereference 2018-05-09 09:51:55 +02:00
pnp License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
power power: supply: axp288_charger: Properly stop work on probe-error / remove 2018-04-12 12:32:17 +02:00
powercap
…
pps
…
ps3
…
ptp License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pwm pwm: rcar: Fix a condition to prevent mismatch value setting to duty 2018-04-24 09:36:34 +02:00
rapidio drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak in error handling path in 'rio_dma_transfer()' 2017-12-14 09:53:08 +01:00
ras License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
regulator regulator: stm32-vrefbuf: fix check on ready flag 2018-03-15 10:54:28 +01:00
remoteproc License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
reset License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
rpmsg rpmsg: glink: Initialize the "intent_req_comp" completion variable 2017-12-20 10:10:29 +01:00
rtc rtc: goldfish: Add missing MODULE_LICENSE 2018-05-25 16:18:02 +02:00
s390 s390/cio: clear timer when terminating driver I/O 2018-05-30 07:52:01 +02:00
sbus License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
scsi sr: pass down correctly sized SCSI sense buffer 2018-05-30 07:51:49 +02:00
sfi
…
sh License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sn
…
soc soc: imx: gpc: de-register power domains only if initialized 2018-05-30 07:52:00 +02:00
spi spi: bcm-qspi: Always read and set BSPI_MAST_N_BOOT_CTRL 2018-05-22 18:53:56 +02:00
spmi
…
ssb License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
staging staging: lustre: lmv: correctly iput lmo_root 2018-05-25 16:17:44 +02:00
target scsi: target: Fix fortify_panic kernel exception 2018-05-09 09:51:51 +02:00
tc
…
tee tee: shm: fix use-after-free via temporarily dropped reference 2018-05-22 18:53:57 +02:00
thermal thermal: exynos: Propagate error value from tmu_read() 2018-05-16 10:10:30 +02:00
thunderbolt thunderbolt: Prevent crash when ICM firmware is not running 2018-04-24 09:36:29 +02:00
tty serial: altera: ensure port->regshift is honored consistently 2018-05-25 16:18:00 +02:00
uio uio_hv_generic: check that host supports monitor page 2018-04-12 12:32:19 +02:00
usb xhci: workaround for AMD Promontory disabled ports wakeup 2018-05-30 07:51:56 +02:00
uwb License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
vfio vfio/pci: Virtualize Maximum Read Request Size 2018-04-24 09:36:34 +02:00
vhost vhost: Fix vhost_copy_to_user() 2018-04-19 08:56:16 +02:00
video backlight: tdo24m: Fix the SPI CS between transfers 2018-04-12 12:32:16 +02:00
virt
…
virtio virtio_ring: fix num_free handling in error case 2018-03-15 10:54:32 +01:00
vlynq
…
vme License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
w1 License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
watchdog watchdog: sp5100_tco: Fix watchdog disable bit 2018-04-26 11:02:08 +02:00
xen xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent 2018-05-30 07:51:48 +02:00
zorro License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile usb: build drivers/usb/common/ when USB_SUPPORT is set 2018-02-25 11:07:53 +01:00