Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1164885AbdDYGuE (ORCPT ); Tue, 25 Apr 2017 02:50:04 -0400 Received: from m12-16.163.com ([220.181.12.16]:51381 "EHLO m12-16.163.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1760528AbdDYGt5 (ORCPT ); Tue, 25 Apr 2017 02:49:57 -0400 From: Heloise To: philipp.reisner@linbit.com, lars.ellenberg@linbit.com Cc: drbd-dev@lists.linbit.com, linux-kernel@vger.kernel.org, Heloise Subject: [PATCH] drivers:block:drbd:drbd_state:fix null-pointer dereference Date: Mon, 24 Apr 2017 23:35:18 -0700 Message-Id: <1493102118-8086-1-git-send-email-os@iscas.ac.cn> X-Mailer: git-send-email 2.1.0 X-CM-TRANSID: EMCowAA3jjJk8f5Yv_xmAg--.47004S2 X-Coremail-Antispam: 1Uf129KBjvdXoWrtr1fWF4xXF48Gr48ur1DGFg_yoWfurc_Cw 4Sqrn3Zr4vkr47C34Dtr95Aa9Y9ayDXr93uw12qanxAa9FgFW3J3srWF9Y939xu34UGrs3 tFy3Xw1jvr1q9jkaLaAFLSUrUUUUbb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IUn58n7UUUUU== X-Originating-IP: [124.16.139.198] X-CM-SenderInfo: xnhu0vxosd3uhkbx1vxdwhqiywtou0bp/1tbiJwXEglXlikeP+gAAss Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 906 Lines: 26 Signed-off-by: Heloise In is_valid_state(), there is NULL validation for the variable nc "if (nc)". However,the code will continue to execute when nc is NULL. nc->verify_alg[0] is used in subsequent code, which may cause null-pointer dereference, fix it. --- drivers/block/drbd/drbd_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c index eea0c4a..1963b83 100644 --- a/drivers/block/drbd/drbd_state.c +++ b/drivers/block/drbd/drbd_state.c @@ -845,7 +845,7 @@ is_valid_state(struct drbd_device *device, union drbd_state ns) rv = SS_CONNECTED_OUTDATES; else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && - (nc->verify_alg[0] == 0)) + (nc != NULL && nc->verify_alg[0] == 0)) rv = SS_NO_VERIFY_ALG; else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && -- 2.1.0