From fa14e328f8c00e509e6b35c5128d959a8fc0dcff Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 21 Apr 2025 10:01:40 +0800 Subject: [PATCH 1/2] md/raid1: don't free conf on raid0_run failure mainline inclusion from mainline-v6.11-rc1 commit 799af947ed132956d6de6d77a5bc053817ccb06b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=799af947ed132956d6de6d77a5bc053817ccb06b ------------------ The core md code calls the ->free method which already frees conf. Fixes: 07f1a6850c5d ("md/raid1: fail run raid1 array when active disk less than one") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20240613084839.1044015-4-hch@lst.de Signed-off-by: Jens Axboe Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing --- drivers/md/raid1.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 52d04da83d88..91a65b888620 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -3063,7 +3063,6 @@ static struct r1conf *setup_conf(struct mddev *mddev) return ERR_PTR(err); } -static void raid1_free(struct mddev *mddev, void *priv); static int raid1_run(struct mddev *mddev) { struct r1conf *conf; @@ -3116,8 +3115,7 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(mddev, &conf->thread); - ret = -EINVAL; - goto abort; + return -EINVAL; } if (conf->raid_disks - mddev->degraded == 1) @@ -3141,14 +3139,8 @@ static int raid1_run(struct mddev *mddev) md_set_array_sectors(mddev, raid1_size(mddev, 0, 0)); ret = md_integrity_register(mddev); - if (ret) { + if (ret) md_unregister_thread(mddev, &mddev->thread); - goto abort; - } - return 0; - -abort: - raid1_free(mddev, conf); return ret; } -- Gitee From e34f24724b4bbc4801c47dc828193dafe8bcad76 Mon Sep 17 00:00:00 2001 From: Zheng Qixing Date: Mon, 21 Apr 2025 10:01:41 +0800 Subject: [PATCH 2/2] md/raid1: fix memory leak in raid1_run() if no active rdev maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKXOB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux.git/commit/?h=md-6.15&id=5fbcf76e0dfe68578ffa2a8a691cc44cf586ae35 ---------------------- When `raid1_set_limits()` fails or when the array has no active `rdev`, the allocated memory for `conf` is not properly freed. Add raid1_free() call to properly free the conf in error path. Fixes: 799af947ed13 ("md/raid1: don't free conf on raid0_run failure") Signed-off-by: Zheng Qixing Conflicts: drivers/md/raid1.c [Context conflicts.] Signed-off-by: Zheng Qixing --- drivers/md/raid1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 91a65b888620..1be011a700f8 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -45,6 +45,7 @@ static void allow_barrier(struct r1conf *conf, sector_t sector_nr); static void lower_barrier(struct r1conf *conf, sector_t sector_nr); +static void raid1_free(struct mddev *mddev, void *priv); #define raid1_log(md, fmt, args...) \ do { if ((md)->queue) blk_add_trace_msg((md)->queue, "raid1 " fmt, ##args); } while (0) @@ -3115,6 +3116,8 @@ static int raid1_run(struct mddev *mddev) */ if (conf->raid_disks - mddev->degraded < 1) { md_unregister_thread(mddev, &conf->thread); + if (!mddev->private) + raid1_free(mddev, conf); return -EINVAL; } -- Gitee