Bug 530066

Moved delete_partition() panic reported by customer in bug #493517 to this one as every bug must target only one issue. part_round_stats() panic will be fixed in bug #493517. Further investigation should be done for delete_partition() panic in this bugzilla.


Description of problem:

Unable to handle kernel NULL pointer dereference at 0000000000000040 RIP:
[<ffffffff801161d4>] delete_partition+0x8f/0x114

void delete_partition(struct gendisk *disk, int part)
{      
       struct hd_struct *p = disk->part[part-1];
…
       p->sectors[0] = p->sectors[1] = 0;
       part_stat_reset(p);                                 <<<<< This is something added in 2.6.18-123.
       sysfs_remove_link(&p->kobj, "subsystem");
}   

static inline void part_stat_reset(struct hd_struct *part)
{      
       struct partstats *ps;
       int i;  
       rcu_read_lock();
       ps = get_partstats(part);   <<<<< get_partstats returned NULL
       for_each_possible_cpu(i)
               memset(per_cpu_ptr(ps->dkstats, i), 0,   <<<<< ps is NULL, panic here.
                      sizeof(struct disk_stats));              
       rcu_read_unlock();
}

How reproducible:
Not sure how to reproduce it.  From the code, it should check the return value of get_partstats() before dereferencing it.

Steps to Reproduce:
Reproducer from customer available in https://bugzilla.redhat.com/show_bug.cgi?id=493517#c8. However this reproducer never triggered delete_partition() panic.

Actual results:
Panic.

Expected results:
No panic.

Additional info:
See bug #493517.