From: Yufen Yu <yuyufen@huawei.com>
Date: Tue, 2 Apr 2019 06:22:14 +0000 (+0800)
Subject: md: add mddev->pers to avoid potential NULL pointer dereference
X-Git-Tag: v4.19.46~89
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=10cb519c3e3417c00eae7ca8e97588eb1ff83b53;p=platform%2Fkernel%2Flinux-rpi.git

md: add mddev->pers to avoid potential NULL pointer dereference

commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.

When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
which can avoid potential NULL pointer derefence in fallowing
add_bound_rdev().

Fixes: a6da4ef85cef ("md: re-add a failed disk")
Cc: Xiao Ni <xni@redhat.com>
Cc: NeilBrown <neilb@suse.com>
Cc: <stable@vger.kernel.org> # 4.4+
Reviewed-by: NeilBrown <neilb@suse.com>
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4bd04dd..b924f62 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2860,8 +2860,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 			err = 0;
 		}
 	} else if (cmd_match(buf, "re-add")) {
-		if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
-			rdev->saved_raid_disk >= 0) {
+		if (!rdev->mddev->pers)
+			err = -EINVAL;
+		else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+				rdev->saved_raid_disk >= 0) {
 			/* clear_bit is performed _after_ all the devices
 			 * have their local Faulty bit cleared. If any writes
 			 * happen in the meantime in the local node, they