• NeilBrown's avatar
    md: protect against NULL reference when waiting to start a raid10. · 589a594b
    NeilBrown authored
    When we fail to start a raid10 for some reason, we call
    md_unregister_thread to kill the thread that was created.
    
    Unfortunately md_thread() will then make one call into the handler
    (raid10d) even though md_wakeup_thread has not been called.  This is
    not safe and as md_unregister_thread is called after mddev->private
    has been set to NULL, it will definitely cause a NULL dereference.
    
    So fix this at both ends:
     - md_thread should only call the handler if THREAD_WAKEUP has been
       set.
     - raid10 should call md_unregister_thread before setting things
       to NULL just like all the other raid modules do.
    
    This is applicable to 2.6.35 and later.
    
    Cc: stable@kernel.org
    Reported-by: default avatar"Citizen" <citizen_lee@thecus.com>
    Signed-off-by: default avatarNeilBrown <neilb@suse.de>
    589a594b
md.c 190 KB