linux-kernel - Re: [PATCH] md/raid1: fix memory leak in raid1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9d522ca3-30ab-f86d-4e50-f29d780e148d@huaweicloud.com>
Date: Sat, 31 Jan 2026 09:45:45 +0800
From: Li Nan <linan666@...weicloud.com>
To: Zilin Guan <zilin@....edu.cn>, song@...nel.org
Cc: yukuai@...as.com, linux-raid@...r.kernel.org,
 linux-kernel@...r.kernel.org, jianhao.xu@....edu.cn
Subject: Re: [PATCH] md/raid1: fix memory leak in raid1_run()



在 2026/1/26 15:15, Zilin Guan 写道:
> raid1_run() calls setup_conf() which registers a thread via
> md_register_thread(). If raid1_set_limits() fails, the previously
> registered thread is not unregistered, resulting in a memory leak
> of the md_thread structure and the thread resource itself.
> 
> Add md_unregister_thread() to the error path to properly cleanup
> the thread, which aligns with the error handling logic of other paths
> in this function.
> 
> Compile tested only. Issue found using a prototype static analysis tool
> and code review.
> 
> Fixes: 97894f7d3c29 ("md/raid1: use the atomic queue limit update APIs")
> Signed-off-by: Zilin Guan <zilin@....edu.cn>
> ---
>   drivers/md/raid1.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
> index 57d50465eed1..cc9914bd15c1 100644
> --- a/drivers/md/raid1.c
> +++ b/drivers/md/raid1.c
> @@ -3254,6 +3254,7 @@ static int raid1_run(struct mddev *mddev)
>   	if (!mddev_is_dm(mddev)) {
>   		ret = raid1_set_limits(mddev);
>   		if (ret) {
> +			md_unregister_thread(mddev, &conf->thread);
>   			if (!mddev->private)
>   				raid1_free(mddev, conf);
>   			return ret;

LGTM

Reviewed-by: Li Nan <linan122@...wei.com>

-- 
Thanks,
Nan