From: "yu kuai" <yukuai@fygo.io>
To: <ghuicao@163.com>, "Song Liu" <song@kernel.org>,
"yu kuai" <yukuai@fygo.io>
Cc: "Li Nan" <magiclinan@didiglobal.com>, "Xiao Ni" <xiao@kernel.org>,
<linux-raid@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
<stable@vger.kernel.org>,
"Cao Guanghui" <caoguanghui@kylinos.cn>
Subject: Re: [PATCH v4 1/2] md/raid5: track disks array size to fix extra_page leak on error paths
Date: Sat, 5 Sep 2026 10:34:59 +0800 [thread overview]
Message-ID: <28837a31-ccbe-4add-951e-9e09bf06eadf@fygo.io> (raw)
In-Reply-To: <20260827080341.112296-1-ghuicao@163.com>
在 2026/8/27 16:03, ghuicao@163.com 写道:
> From: Cao Guanghui<caoguanghui@kylinos.cn>
>
> free_conf() iterates conf->pool_size entries to free extra_page
> allocations, but pool_size may not reflect the actual size of the
> conf->disks array. Two scenarios cause a mismatch:
>
> 1. setup_conf() early abort: pool_size is 0 (not yet set by
> grow_stripes) but conf->disks has max_disks entries with
> extra_page allocated. The loop iterates 0 times, leaking all
> pages.
>
> 2. resize_stripes() Step 4 failure: conf->disks was replaced with
> a newsize-entry array in Step 3, but pool_size is only updated
> on success. The loop iterates pool_size (old, smaller value)
> times, leaking (newsize - pool_size) pages.
>
> Add a dedicated disks_cnt field to track the actual number of
> entries in conf->disks. Set it immediately after each allocation
> or replacement (in setup_conf and resize_stripes Step 3, where the
> array is safely stalled with no concurrent access), and use it in
> free_conf() instead of pool_size.
>
> This leaves pool_size untouched, preserving the check_reshape()
> retry behavior that depends on pool_size only being updated on
> full success.
>
> Fixes: d7bd398e97f2 ("md/r5cache: handle alloc_page failure")
> Cc:stable@vger.kernel.org
> Signed-off-by: Cao Guanghui<caoguanghui@kylinos.cn>
> ---
> drivers/md/raid5.c | 4 +++-
> drivers/md/raid5.h | 1 +
> 2 files changed, 4 insertions(+), 1 deletion(-)
Applied v4 to md-7.3.
--
Thanks,
Kuai
prev parent reply other threads:[~2026-09-05 2:35 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-27 2:38 [PATCH] md/raid5: set pool_size before extra_page allocation to fix leak on error path ghuicao
2026-08-27 2:53 ` sashiko-bot
2026-08-27 6:05 ` [PATCH v2 1/3] " ghuicao
2026-08-27 6:05 ` [PATCH v2 2/3] md/raid5: fix leak and use-after-free in resize_stripes " ghuicao
2026-08-27 6:27 ` sashiko-bot
2026-08-27 6:05 ` [PATCH v2 3/3] md/raid5: fix NULL pointer dereference in raid5_free_percpu ghuicao
2026-08-27 6:18 ` sashiko-bot
2026-08-27 6:27 ` [PATCH v2 1/3] md/raid5: set pool_size before extra_page allocation to fix leak on error path sashiko-bot
2026-08-27 6:32 ` [PATCH v3 " ghuicao
2026-08-27 6:32 ` [PATCH v3 2/3] md/raid5: fix leak and use-after-free in resize_stripes " ghuicao
2026-08-27 7:02 ` sashiko-bot
2026-08-27 6:32 ` [PATCH v3 3/3] md/raid5: fix NULL pointer dereference in raid5_free_percpu ghuicao
2026-08-27 7:17 ` sashiko-bot
2026-08-27 8:03 ` [PATCH v4 1/2] md/raid5: track disks array size to fix extra_page leak on error paths ghuicao
2026-08-27 8:03 ` [PATCH v4 2/2] md/raid5: fix NULL pointer dereference in raid5_free_percpu ghuicao
2026-08-27 8:19 ` [PATCH v4 1/2] md/raid5: track disks array size to fix extra_page leak on error paths sashiko-bot
2026-09-05 2:34 ` yu kuai [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=28837a31-ccbe-4add-951e-9e09bf06eadf@fygo.io \
--to=yukuai@fygo.io \
--cc=caoguanghui@kylinos.cn \
--cc=ghuicao@163.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-raid@vger.kernel.org \
--cc=magiclinan@didiglobal.com \
--cc=song@kernel.org \
--cc=stable@vger.kernel.org \
--cc=xiao@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.