linux-kernel - [2.6.25 patch] dm-raid1.c: fix NULL dereferences

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080219193057.GJ31955@cs181133002.pp.htv.fi>
Date:	Tue, 19 Feb 2008 21:30:57 +0200
From:	Adrian Bunk <bunk@...nel.org>
To:	Jonathan Brassow <jbrassow@...hat.com>,
	Alasdair G Kergon <agk@...hat.com>
Cc:	linux-kernel@...r.kernel.org
Subject: [2.6.25 patch] dm-raid1.c: fix NULL dereferences

This patch fixes two NULL dereferences introduced by
commit 06386bbfd2441416875d0403d405c56822f6ebac and spotted by the 
Coverity checker.

Signed-off-by: Adrian Bunk <bunk@...nel.org>

---

 drivers/md/dm-raid1.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- linux-2.6/drivers/md/dm-raid1.c.old	2008-02-19 21:14:33.000000000 +0200
+++ linux-2.6/drivers/md/dm-raid1.c	2008-02-19 21:17:04.000000000 +0200
@@ -1673,58 +1673,59 @@ static int mirror_end_io(struct dm_targe
 	struct mirror *m = NULL;
 	struct dm_bio_details *bd = NULL;
 	struct dm_raid1_read_record *read_record = map_context->ptr;
 
 	/*
 	 * We need to dec pending if this was a write.
 	 */
 	if (rw == WRITE) {
 		rh_dec(&ms->rh, map_context->ll);
 		return error;
 	}
 
 	if (error == -EOPNOTSUPP)
 		goto out;
 
 	if ((error == -EWOULDBLOCK) && bio_rw_ahead(bio))
 		goto out;
 
 	if (unlikely(error)) {
 		if (!read_record) {
 			/*
 			 * There wasn't enough memory to record necessary
 			 * information for a retry or there was no other
 			 * mirror in-sync.
 			 */
-			DMERR_LIMIT("Mirror read failed from %s.",
-				    m->dev->name);
+			DMERR_LIMIT("Mirror read failed.");
 			return -EIO;
 		}
+
+		m = read_record->m;
+
 		DMERR("Mirror read failed from %s. Trying alternative device.",
 		      m->dev->name);
 
-		m = read_record->m;
 		fail_mirror(m, DM_RAID1_READ_ERROR);
 
 		/*
 		 * A failed read is requeued for another attempt using an intact
 		 * mirror.
 		 */
 		if (default_ok(m) || mirror_available(ms, bio)) {
 			bd = &read_record->details;
 
 			dm_bio_restore(bd, bio);
 			mempool_free(read_record, ms->read_record_pool);
 			map_context->ptr = NULL;
 			queue_bio(ms, bio, rw);
 			return 1;
 		}
 		DMERR("All replicated volumes dead, failing I/O");
 	}
 
 out:
 	if (read_record) {
 		mempool_free(read_record, ms->read_record_pool);
 		map_context->ptr = NULL;
 	}
 
 	return error;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/