From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.127.231.46 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793674845; b=pUrHu960OogeeyTmaUCWEuAp6sm9C1g2KK+dnQsonfRMC0TgWNli6J/GuXixyEMLmaX7 BNZn4iC7MI0MegIRCKZwlL1DVJteCuuLy7HnNoTM4jSnyH+NFyHnu1RfforL8CY4e2hbb 5RveNzOA6LHivZgZ0NvUR+GxiInbCBqwGUzt0mHEmVG/esa/N4jMZVYcISEI2WUXInPDh 3nvDIrTX59kX7rUKd8ammXtI+ZnGnhP4TKXG2iAf8zwVnXDqWE0p3rrWMVkgflkNI1cRx m9NgL9mnsfmVRmoUZrAVZZRUO2FTxsO+mTbjB7hBc3CUOHTIt01N36EdCCipZDU79/g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793674845; h=DMARC-Filter:DKIM-Signature:Content-Transfer-Encoding:Reply-To: Subject:Date:Content-Type:User-Agent:Received:In-Reply-To:To: Message-Id:Mime-Version:References:X-Lms-Return-Path:Cc:From: X-Original-From; bh=vRI5i2y5I87cckdxctkq1xjIZOtIfuEUygOpiVqLqns=; b=kduedZOdkg9Y4hmJUS1FEjm40U7AHhBP5LIc0mR+xKJZiCgFlKLOhUgzLnQKeFRSf/lE xlhQ3D5p2KeMlQDbCueGpDvX9rFcFdIyWYKdhotzr5WedTqUgRDTNhw5WBmEukt5nwdgR F+cpvFJmdXcjoqnz44RRFtq5TMDulveP0ySbBSYSLzyr6h+fg45lTRajSZTSIdoNXN9Me HuCMH7PwgE48juJHYRpJPnbn9KyDkvg32VunZ17/L+4JRz1SFbhvy7PdmiqMSe7g6NjZW XuO5xR/jZjrybzyipS5i+cFzUetsq0/PuBaqMsPvuWl6wbAELuaVbE/Qo1c9fuc/hZg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=fygo.io; spf=pass smtp.mailfrom=fygo.io; dkim=pass header.d=fygo-io.20200929.dkim.larksuite.com header.i=@fygo-io.20200929.dkim.larksuite.com header.a=rsa-sha256 header.s=s1 header.b="QGym7/vd"; arc=none smtp.remote-ip=209.127.231.46 Received: from va-2-46.ptr.blmpb.com (va-2-46.ptr.blmpb.com [209.127.231.46]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62A62606A329 for ; Tue, 3 Nov 2026 03:00:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 62A62606A329 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=fygo.io Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fygo.io Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=fygo-io.20200929.dkim.larksuite.com header.i=@fygo-io.20200929.dkim.larksuite.com header.a=rsa-sha256 header.s=s1 header.b=QGym7/vd DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=s1; d=fygo-io.20200929.dkim.larksuite.com; t=1793674838; h=from:subject:mime-version:from:date:message-id:subject:to:cc: reply-to:content-type:mime-version:in-reply-to:message-id; bh=vRI5i2y5I87cckdxctkq1xjIZOtIfuEUygOpiVqLqns=; b=QGym7/vdsBCC2gFRJPPUAIplJ8qWW0V2UYQUEjUYWovDVVvlrhQirKkSVavrSTrqzXtV+A 4bKqp6HF7ilQQqqm38s8y+uMZv1Oh6mjB54FoUN4iSF1bwMz79BacH7SSlaiCIw6K0JeJQ cO9SeymikHhaLLbeZGcHINo0RfjnyMw18MKErjy5Yl8HMmKLnMSAKNpbEOGdab91WySqQX JZsInyN1D6rNOjK58OldBx+2v+a/FsgHwhlDeI98SGxImsBnKpsZPX2HriDyiwyzBcENdw iZTKBFutQFvDAcmvUGqREZwRDX4Ihs9lBfst4HBJgppJ8iA0G7qZkSL8yPN53g== Content-Transfer-Encoding: quoted-printable Reply-To: yukuai@fygo.io Subject: Re: [PATCH] md/raid5: Cancel remove instance if adding it fails Date: Tue, 3 Nov 2026 11:00:33 +0800 Content-Type: text/plain; charset=UTF-8 User-Agent: Mozilla Thunderbird Received: from [192.168.1.104] ([39.182.0.25]) by smtp.larksuite.com with ESMTPS; Tue, 03 Nov 2026 03:00:37 +0000 In-Reply-To: <20261030105614.378971-1-eadavis@sina.com> To: "Edward Adam Davis" , , "yu kuai" Message-Id: X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <6ae34c61.bc88765f.313a3f.00b3.GAE@google.com> <20261030105614.378971-1-eadavis@sina.com> X-Lms-Return-Path: Cc: , , , , , , , , From: "yu kuai" X-Original-From: yu kuai Hi, =E5=9C=A8 2026/10/30 18:56, Edward Adam Davis =E5=86=99=E9=81=93: > The failure of raid456_cpu_up_prepare() to allocate memory causes > cpuhp_state_add_instance() to fail; consequently, the corresponding > instance is not initialized, potentially hitting [1]. > > Additionally, there is another null-ptr-deref issue: conf->mddev is > assigned too late, meaning that any error-handling exit occurring before > this assignment, which jumps to the abort label, potentially hitting [2]. > > [1] > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > Call Trace: > cpuhp_state_remove_instance include/linux/cpuhotplug.h:480 [inline] > raid5_free_percpu drivers/md/raid5.c:7541 [inline] > free_conf+0x238/0x710 drivers/md/raid5.c:7554 > setup_conf+0xd80/0x2a20 drivers/md/raid5.c:7885 > raid5_run+0x1260/0x1670 drivers/md/raid5.c:8129 > > [2] > BUG: KASAN: null-ptr-deref in free_conf+0xfd/0x7e0 > Read of size 8 at addr 0000000000000028 by task rp0/9459 > Call Trace: > free_conf+0xfd/0x7e0 > setup_conf.cold+0x6e/0x4a1 > raid5_run+0x1260/0x1670 > > Add a check before removing an instance, if the instance was not successf= ully > added, skip the removal process. Move the assignment of conf->mddev after= the > memory allocation for conf. > > Fixes: 29c6d1bbd7a2 ("md/raid5: Convert to hotplug state machine") > Reported-by: syzbot+08318698e045b4b85f51@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=3D08318698e045b4b85f51 > Signed-off-by: Edward Adam Davis > --- > drivers/md/raid5.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) Looks like this problem is already fixed https://patch.msgid.link/20260827080341.112296-2-ghuicao@163.com https://patch.msgid.link/20260915081731.122933-1-chengzhihao1@huawei.com > > diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c > index b91545ce090d..e1f9ec8f25be 100644 > --- a/drivers/md/raid5.c > +++ b/drivers/md/raid5.c > @@ -7538,7 +7538,8 @@ static void raid5_free_percpu(struct r5conf *conf) > if (!conf->percpu) > return; > =20 > - cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node); > + if (!hlist_unhashed(&conf->node)) > + cpuhp_state_remove_instance(CPUHP_MD_RAID5_PREPARE, &conf->node); > free_percpu(conf->percpu); > } > =20 > @@ -7675,6 +7676,7 @@ static struct r5conf *setup_conf(struct mddev *mdde= v) > if (conf =3D=3D NULL) > goto abort; > =20 > + conf->mddev =3D mddev; > #if PAGE_SIZE !=3D DEFAULT_STRIPE_SIZE > conf->stripe_size =3D DEFAULT_STRIPE_SIZE; > conf->stripe_shift =3D ilog2(DEFAULT_STRIPE_SIZE) - 9; > @@ -7743,7 +7745,6 @@ static struct r5conf *setup_conf(struct mddev *mdde= v) > ret =3D bioset_init(&conf->bio_split, BIO_POOL_SIZE, 0, 0); > if (ret) > goto abort; > - conf->mddev =3D mddev; > =20 > ret =3D -ENOMEM; > conf->stripe_hashtbl =3D kzalloc(PAGE_SIZE, GFP_KERNEL); --=20 Thanks, Kuai