linux-kernel - Re: [PATCH] md-cluster: fix NULL pointer dereference in process_metadata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <caeed769-26ea-4b16-bc7b-6333739ca63b@fnnas.com>
Date: Mon, 26 Jan 2026 13:38:08 +0800
From: "Yu Kuai" <yukuai@...as.com>
To: "Jiasheng Jiang" <jiashengjiangcool@...il.com>, 
	"Song Liu" <song@...nel.org>, <linux-raid@...r.kernel.org>, 
	<linux-kernel@...r.kernel.org>, <yukuai@...as.com>
Subject: Re: [PATCH] md-cluster: fix NULL pointer dereference in process_metadata_update

在 2026/1/17 22:59, Jiasheng Jiang 写道:

> The function process_metadata_update() blindly dereferences the 'thread'
> pointer (acquired via rcu_dereference_protected) within the wait_event()
> macro.
>
> While the code comment states "daemon thread must exist", there is a valid
> race condition window during the MD array startup sequence (md_run):
>
> 1. bitmap_load() is called, which invokes md_cluster_ops->join().
> 2. join() starts the "cluster_recv" thread (recv_daemon).
> 3. At this point, recv_daemon is active and processing messages.
> 4. However, mddev->thread (the main MD thread) is not initialized until
>     later in md_run().
>
> If a METADATA_UPDATED message is received from a remote node during this
> specific window, process_metadata_update() will be called while
> mddev->thread is still NULL, leading to a kernel panic.
>
> To fix this, we must validate the 'thread' pointer. If it is NULL, we
> release the held lock (no_new_dev_lockres) and return early, safely
> ignoring the update request as the array is not yet fully ready to
> process it.
>
> Signed-off-by: Jiasheng Jiang<jiashengjiangcool@...il.com>
> ---
>   drivers/md/md-cluster.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
Applied to md-7.0

-- 
Thansk,
Kuai