linux-kernel - Re: [PATCH v7 2/4] md: init bioset in mddev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c23c005e-ac94-bc99-1469-138e5707e65b@huaweicloud.com>
Date: Wed, 29 Oct 2025 10:35:55 +0800
From: Li Nan <linan666@...weicloud.com>
To: yukuai@...as.com, corbet@....net, song@...nel.org, hare@...e.de,
 xni@...hat.com
Cc: linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-raid@...r.kernel.org, linan666@...weicloud.com, yangerkun@...wei.com,
 yi.zhang@...wei.com
Subject: Re: [PATCH v7 2/4] md: init bioset in mddev_init



在 2025/10/28 20:01, Yu Kuai 写道:
> Hi,
> 
> 在 2025/10/27 15:29, linan122@...wei.com 写道:
>> From: Li Nan <linan122@...wei.com>
>>
>> IO operations may be needed before md_run(), such as updating metadata
>> after writing sysfs. Without bioset, this triggers a NULL pointer
>> dereference as below:
>>
>>    BUG: kernel NULL pointer dereference, address: 0000000000000020
>>    Call Trace:
>>     md_update_sb+0x658/0xe00
>>     new_level_store+0xc5/0x120
>>     md_attr_store+0xc9/0x1e0
>>     sysfs_kf_write+0x6f/0xa0
>>     kernfs_fop_write_iter+0x141/0x2a0
>>     vfs_write+0x1fc/0x5a0
>>     ksys_write+0x79/0x180
>>     __x64_sys_write+0x1d/0x30
>>     x64_sys_call+0x2818/0x2880
>>     do_syscall_64+0xa9/0x580
>>     entry_SYSCALL_64_after_hwframe+0x4b/0x53
>>
>> Reproducer
>> ```
>>     mdadm -CR /dev/md0 -l1 -n2 /dev/sd[cd]
>>     echo inactive > /sys/block/md0/md/array_state
>>     echo 10 > /sys/block/md0/md/new_level
>> ```
>>
>> Fixes: d981ed841930 ("md: Add new_level sysfs interface")
>> Signed-off-by: Li Nan <linan122@...wei.com>
>> ---
>>    drivers/md/md.c | 74 +++++++++++++++++++++++++------------------------
>>    1 file changed, 38 insertions(+), 36 deletions(-)
>>
>> diff --git a/drivers/md/md.c b/drivers/md/md.c
>> index f6fd55a1637b..51f0201e4906 100644
>> --- a/drivers/md/md.c
>> +++ b/drivers/md/md.c
>> @@ -730,6 +730,8 @@ static void mddev_clear_bitmap_ops(struct mddev *mddev)
>>    
>>    int mddev_init(struct mddev *mddev)
>>    {
>> +	int err = 0;
>> +
>>    	if (!IS_ENABLED(CONFIG_MD_BITMAP))
>>    		mddev->bitmap_id = ID_BITMAP_NONE;
>>    	else
>> @@ -741,8 +743,26 @@ int mddev_init(struct mddev *mddev)
>>    
>>    	if (percpu_ref_init(&mddev->writes_pending, no_op,
>>    			    PERCPU_REF_ALLOW_REINIT, GFP_KERNEL)) {
>> -		percpu_ref_exit(&mddev->active_io);
>> -		return -ENOMEM;
>> +		err = -ENOMEM;
>> +		goto exit_acitve_io;
>> +	}
>> +
>> +	if (!bioset_initialized(&mddev->bio_set)) {
>> +		err = bioset_init(&mddev->bio_set, BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS);
> 
> mddev_init() can only be called once for one mddev, no need to test if bioset
> is initialized here.
> 

I will fix it in next version. Thanks for your review.

>> +		if (err)
>> +			goto exit_writes_pending;
>> +	}
>> +	if (!bioset_initialized(&mddev->sync_set)) {
> 
> same here.
> 

-- 
Thanks,
Nan