Commit 5fbcf76e authored by Zheng Qixing's avatar Zheng Qixing Committed by Yu Kuai
Browse files

md/raid1: fix memory leak in raid1_run() if no active rdev 



When `raid1_set_limits()` fails or when the array has no active
`rdev`, the allocated memory for `conf` is not properly freed.

Add raid1_free() call to properly free the conf in error path.

Fixes: 799af947 ("md/raid1: don't free conf on raid0_run failure")
Signed-off-by: default avatarZheng Qixing <zhengqixing@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250215020137.3703757-1-zhengqixing@huaweicloud.com


Singed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
parent 4b10a3bc

drivers/md/raid1.c

+7 −1
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ 


static void allow_barrier(struct r1conf *conf, sector_t sector_nr);

static void lower_barrier(struct r1conf *conf, sector_t sector_nr);

static void raid1_free(struct mddev *mddev, void *priv);



#define RAID_1_10_NAME "raid1"

#include "raid1-10.c"
@@ -3258,9 +3259,12 @@ static int raid1_run(struct mddev *mddev) 


	if (!mddev_is_dm(mddev)) {

		ret = raid1_set_limits(mddev);

		if (ret)

		if (ret) {

			if (!mddev->private)

				raid1_free(mddev, conf);

			return ret;

		}

	}



	mddev->degraded = 0;

	for (i = 0; i < conf->raid_disks; i++)
@@ -3273,6 +3277,8 @@ static int raid1_run(struct mddev *mddev) 
	 */

	if (conf->raid_disks - mddev->degraded < 1) {

		md_unregister_thread(mddev, &conf->thread);

		if (!mddev->private)

			raid1_free(mddev, conf);

		return -EINVAL;

	}