From ae54cae4a5e9d753884fe74f01c32e14dc97b7e7 Mon Sep 17 00:00:00 2001
From: Lars Ellenberg <lars.ellenberg@linbit.com>
Date: Wed, 3 Jul 2024 15:14:49 +0200
Subject: [PATCH 14/79] drbd: clear_peer_slot: give up if drbd_md_get_buffer
 returns NULL

Fixes a NULL deref if it so happens that the disk fails
_just_ when we try to clear a bitmap slot.
---
 drbd/drbd_actlog.c | 14 +++++++++-----
 drbd/drbd_nl.c     |  3 +++
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/drbd/drbd_actlog.c b/drbd/drbd_actlog.c
index 55cbbf610..bc09dee2f 100644
--- a/drbd/drbd_actlog.c
+++ b/drbd/drbd_actlog.c
@@ -36,12 +36,16 @@ void *drbd_md_get_buffer(struct drbd_device *device, const char *intent)
 			device->disk_state[NOW] <= D_FAILED,
 			HZ * 10);
 
-	if (t == 0)
-		drbd_err(device, "Waited 10 Seconds for md_buffer! BUG?\n");
-
 	if (r) {
-		drbd_err(device, "Failed to get md_buffer for %s, currently in use by %s\n",
-			 intent, device->md_io.current_use);
+		if (t == 0) {
+			drbd_err(device, "Waited 10 Seconds for md_buffer! BUG?\n");
+			drbd_err(device, "Failed to get md_buffer for %s, currently in use by %s\n",
+				 intent, device->md_io.current_use);
+		} else {
+			drbd_err(device, "Failed to get md_buffer for %s: disk state %s\n",
+				 intent, drbd_disk_str(device->disk_state[NOW]));
+		}
+
 		return NULL;
 	}
 
diff --git a/drbd/drbd_nl.c b/drbd/drbd_nl.c
index b732fa6f9..40577d30b 100644
--- a/drbd/drbd_nl.c
+++ b/drbd/drbd_nl.c
@@ -2643,6 +2643,8 @@ static int clear_peer_slot(struct drbd_device *device, int peer_node_id, u32 md_
 		freed_index = peer_md->bitmap_index;
 	}
 	buffer = drbd_md_get_buffer(device, __func__); /* lock meta-data IO to superblock */
+	if (buffer == NULL)
+		goto out_no_buffer;
 
 	/* Look for day0 UUID before changing this peer slot to a day0 slot. */
 	day0_md = day0_peer_md(device);
@@ -2687,6 +2689,7 @@ static int clear_peer_slot(struct drbd_device *device, int peer_node_id, u32 md_
 	drbd_md_write(device, buffer);
 	drbd_md_put_buffer(device);
 
+ out_no_buffer:
 	if (free_bitmap_slot)
 		drbd_resume_io(device);
 
-- 
2.33.1.windows.1