| Message ID | 20220401083637.2407766-1-lv.ruyi@zte.com.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | block: fix potential dereference null pointer | expand |
Hi Lv Ruyi, This patch does not make sense to me. A request can only get "TO_BE_SENT" when the connection is established with the corresponding cstate. Establishing a connection can only work if net_conf is set. net_conf can be exchanged to a new one, but never become NULL. Please share more details why you think this NULL check is necessary here? On Fri, Apr 1, 2022 at 10:36 AM <cgel.zte@gmail.com> wrote: > > From: Lv Ruyi <lv.ruyi@zte.com.cn> > > rcu_dereference may return NULL, so check the returned pointer. > > Reported-by: Zeal Robot <zealci@zte.com.cn> > Signed-off-by: Lv Ruyi <lv.ruyi@zte.com.cn> > --- > drivers/block/drbd/drbd_req.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c > index e1e58e91ee58..8ab6da155e2f 100644 > --- a/drivers/block/drbd/drbd_req.c > +++ b/drivers/block/drbd/drbd_req.c > @@ -577,6 +577,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what, > D_ASSERT(device, !(req->rq_state & RQ_NET_MASK)); > rcu_read_lock(); > nc = rcu_dereference(connection->net_conf); > + if (!nc) { > + rcu_read_unlock(); > + break; > + } > p = nc->wire_protocol; > rcu_read_unlock(); > req->rq_state |= > @@ -690,6 +694,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what, > /* close the epoch, in case it outgrew the limit */ > rcu_read_lock(); > nc = rcu_dereference(connection->net_conf); > + if (!nc) { > + rcu_read_unlock(); > + break; > + } > p = nc->max_epoch_size; > rcu_read_unlock(); > if (connection->current_tle_writes >= p) > -- > 2.25.1 >
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c index e1e58e91ee58..8ab6da155e2f 100644 --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -577,6 +577,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what, D_ASSERT(device, !(req->rq_state & RQ_NET_MASK)); rcu_read_lock(); nc = rcu_dereference(connection->net_conf); + if (!nc) { + rcu_read_unlock(); + break; + } p = nc->wire_protocol; rcu_read_unlock(); req->rq_state |= @@ -690,6 +694,10 @@ int __req_mod(struct drbd_request *req, enum drbd_req_event what, /* close the epoch, in case it outgrew the limit */ rcu_read_lock(); nc = rcu_dereference(connection->net_conf); + if (!nc) { + rcu_read_unlock(); + break; + } p = nc->max_epoch_size; rcu_read_unlock(); if (connection->current_tle_writes >= p)