Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10134 -------------------------------- md_check_no_bitmap() dereferences mddev->pers->name to print the personality name when an array has a bitmap configured but the personality does not support bitmaps. Commit 36d091f4759d ("md: protect ->pers changes with mddev->lock") moved the assignment mddev->pers = pers to after pers->run(), so mddev->pers is still NULL when md_check_no_bitmap() is called from the ->run method of raid0 and linear: do_md_run md_run pers->run(mddev) <- mddev->pers still NULL raid0_run / linear_run md_check_no_bitmap mddev->pers->head.name <- NULL pointer dereference The early-return check in md_check_no_bitmap() can be bypassed because the bitmap can be configured while pers is NULL: set_bitmap_file() (via SET_BITMAP_FILE ioctl) sets bitmap_info.file directly, and location_store() (via sysfs bitmap/location) sets bitmap_info.offset. Both md_run() and the level_store() takeover path set mddev->clevel via strscpy(mddev->clevel, pers->name, ...) before calling pers->run(), making mddev->clevel a safe substitute for printing the personality name. Fixes: 36d091f4759d ("md: protect ->pers changes with mddev->lock") Signed-off-by: Zhou Minqiang <zhouminqiang2@huawei.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4ddb56d7408a..2952b178f016 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1170,7 +1170,7 @@ int md_check_no_bitmap(struct mddev *mddev) if (!mddev->bitmap_info.file && !mddev->bitmap_info.offset) return 0; pr_warn("%s: bitmaps are not supported for %s\n", - mdname(mddev), mddev->pers->name); + mdname(mddev), mddev->clevel); return 1; } EXPORT_SYMBOL(md_check_no_bitmap); -- 2.52.0