[PATCH OLK-6.6 0/2] md/raid1: fix memleak and double free in
Fix memleak and double free in raid1_run(). Christoph Hellwig (1): md/raid1: don't free conf on raid0_run failure Zheng Qixing (1): md/raid1: fix memory leak in raid1_run() if no active rdev drivers/md/raid1.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) -- 2.39.2
From: Christoph Hellwig <hch@lst.de> mainline inclusion from mainline-v6.11-rc1 commit 799af947ed132956d6de6d77a5bc053817ccb06b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------ The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Link: https://lore.kernel.org/r/20240613084839.1044015-4-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 3fc9cc7c4327..b94ef54c5262 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3086,7 +3086,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3139,8 +3138,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(mddev, &conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3164,14 +3162,8 @@ static int raid1_run(struct mddev *mddev) md_set_array_sectors(mddev, raid1_size(mddev, 0, 0)); ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(mddev, &mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- 2.39.2
maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux.git/commit/?h=m... ---------------------- When `raid1_set_limits()` fails or when the array has no active `rdev`, the allocated memory for `conf` is not properly freed. Add raid1_free() call to properly free the conf in error path. Fixes: 799af947ed13 ("md/raid1: don't free conf on raid0_run failure") Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> --- drivers/md/raid1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index b94ef54c5262..60ed3576c25d 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -45,6 +45,7 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr); static void lower_barrier(struct r1conf *conf, sector_t sector_nr); +static void raid1_free(struct mddev *mddev, void *priv); #define raid1_log(md, fmt, args...) \ do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0) @@ -3138,6 +3139,8 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(mddev, &conf->thread); + if (!mddev->private) + raid1_free(mddev, conf); return -EINVAL; } -- 2.39.2
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://gitee.com/openeuler/kernel/pulls/15937 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/TDQ... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://gitee.com/openeuler/kernel/pulls/15937 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/TDQ...
participants (2)
-
patchwork bot -
Zheng Qixing