Commit e8b84915 authored Jan 06, 2014 by NeilBrown

md/raid10: fix bug when raid10 recovery fails to recover a block.



commit e875ecea
    md/raid10 record bad blocks as needed during recovery.

added code to the "cannot recover this block" path to record a bad
block rather than fail the whole recovery.
Unfortunately this new case was placed *after* r10bio was freed rather
than *before*, yet it still uses r10bio.
This is will crash with a null dereference.

So move the freeing of r10bio down where it is safe.

Cc: stable@vger.kernel.org (v3.1+)
Fixes: e875ecea
Reported-by: Damian Nowak <spam@nowaker.net>
URL: https://bugzilla.kernel.org/show_bug.cgi?id=68181


Signed-off-by: NeilBrown <neilb@suse.de>

parent 5af9bef7

drivers/md/raid10.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -3218,10 +3218,6 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
		if (j == conf->copies) {
		/* Cannot recover, so abort the recovery or
		* record a bad block */
		put_buf(r10_bio);
		if (rb2)
		atomic_dec(&rb2->remaining);
		r10_bio = rb2;
		if (any_working) {
		/* problem is that there are bad blocks
		* on other device(s)
		@@ -3253,6 +3249,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
		mirror->recovery_disabled
		= mddev->recovery_disabled;
		}
		put_buf(r10_bio);
		if (rb2)
		atomic_dec(&rb2->remaining);
		r10_bio = rb2;
		break;
		}
		}