2008-02-19 19:32:27

by Adrian Bunk

[permalink] [raw]
Subject: [2.6.25 patch] dm-raid1.c: fix NULL dereferences

This patch fixes two NULL dereferences introduced by
commit 06386bbfd2441416875d0403d405c56822f6ebac and spotted by the
Coverity checker.

Signed-off-by: Adrian Bunk <[email protected]>

---

drivers/md/dm-raid1.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)

--- linux-2.6/drivers/md/dm-raid1.c.old 2008-02-19 21:14:33.000000000 +0200
+++ linux-2.6/drivers/md/dm-raid1.c 2008-02-19 21:17:04.000000000 +0200
@@ -1673,58 +1673,59 @@ static int mirror_end_io(struct dm_targe
struct mirror *m = NULL;
struct dm_bio_details *bd = NULL;
struct dm_raid1_read_record *read_record = map_context->ptr;

/*
* We need to dec pending if this was a write.
*/
if (rw == WRITE) {
rh_dec(&ms->rh, map_context->ll);
return error;
}

if (error == -EOPNOTSUPP)
goto out;

if ((error == -EWOULDBLOCK) && bio_rw_ahead(bio))
goto out;

if (unlikely(error)) {
if (!read_record) {
/*
* There wasn't enough memory to record necessary
* information for a retry or there was no other
* mirror in-sync.
*/
- DMERR_LIMIT("Mirror read failed from %s.",
- m->dev->name);
+ DMERR_LIMIT("Mirror read failed.");
return -EIO;
}
+
+ m = read_record->m;
+
DMERR("Mirror read failed from %s. Trying alternative device.",
m->dev->name);

- m = read_record->m;
fail_mirror(m, DM_RAID1_READ_ERROR);

/*
* A failed read is requeued for another attempt using an intact
* mirror.
*/
if (default_ok(m) || mirror_available(ms, bio)) {
bd = &read_record->details;

dm_bio_restore(bd, bio);
mempool_free(read_record, ms->read_record_pool);
map_context->ptr = NULL;
queue_bio(ms, bio, rw);
return 1;
}
DMERR("All replicated volumes dead, failing I/O");
}

out:
if (read_record) {
mempool_free(read_record, ms->read_record_pool);
map_context->ptr = NULL;
}

return error;