2.4.25 MD RAID 1 driver - memory leak?

2.4.25 MD RAID 1 driver - memory leak?

[Mark Bellon]

[-- Attachment #1: Type: text/plain, Size: 466 bytes --]

If I'm reading things correctly I believe there is a memory leak in the 
RAID 1 driver. A patch is attached for the fix.

The end_sync_read function forwards the read operation (r1_bh) that 
completed by the raid1_reschedule_retry function. The r1_bh->cmd value 
is SPECIAL. If the R1BH_Uptodate bit is not set a message is printed and 
md_done_sync is called - but raid1_free_buf is not called. Look a few 
lines above at the "!sum_bhs" case for comparison.

mark


[-- Attachment #2: raid1-patch --]
[-- Type: text/plain, Size: 282 bytes --]

--- raid1.c.orig	2004-03-23 16:09:48.000000000 -0700
+++ raid1.c	2004-03-23 16:09:18.000000000 -0700
@@ -1252,6 +1252,7 @@
 
 				printk (IO_ERROR, partition_name(bh->b_dev), bh->b_blocknr);
 				md_done_sync(mddev, bh->b_size>>9, 0);
+				raid1_free_buf(r1_bh);
 			}
 
 			break;

Re: 2.4.25 MD RAID 1 driver - syncing hung due to I/O error

[Mark Bellon]

[-- Attachment #1: Type: text/plain, Size: 547 bytes --]

One of my disks has a bad block and hung while syncing (as the source of 
the sync) when it was read. A patch is attached for the fix.

The sync_request_done function is called after each sync I/O request 
completes regardless of the error outcome.
See end_sync_write and the "!sum_bhs" case a few lines above the patch 
location for references. If sync_request_done is not called the 
accounting is not updated and sooner or later things will hang. The 
R1BH_Uptodate not set case (read I/O error) does not do this and the 
problem occurs.

mark

[-- Attachment #2: raid1-patch-2 --]
[-- Type: text/plain, Size: 323 bytes --]

--- raid1.c.orig	2004-03-23 17:18:29.000000000 -0700
+++ raid1.c	2004-03-23 17:18:48.000000000 -0700
@@ -1251,6 +1251,7 @@
 				 */
 
 				printk (IO_ERROR, partition_name(bh->b_dev), bh->b_blocknr);
+				sync_request_done(bh->b_blocknr, conf);
 				md_done_sync(mddev, bh->b_size>>9, 0);
 				raid1_free_buf(r1_bh);
 			}