Re: [PATCH v3] md/raid1: Fix stack memory use after return in raid1_reshape

[Yu Kuai]

在 2025/06/12 19:28, Wang Jinchao 写道:
> In the raid1_reshape function, newpool is
> allocated on the stack and assigned to conf->r1bio_pool.
> This results in conf->r1bio_pool.wait.head pointing
> to a stack address.
> Accessing this address later can lead to a kernel panic.
>
> Example access path:
>
> raid1_reshape()
> {
> 	// newpool is on the stack
> 	mempool_t newpool, oldpool;
> 	// initialize newpool.wait.head to stack address
> 	mempool_init(&newpool, ...);
> 	conf->r1bio_pool = newpool;
> }
>
> raid1_read_request() or raid1_write_request()
> {
> 	alloc_r1bio()
> 	{
> 		mempool_alloc()
> 		{
> 			// if pool->alloc fails
> 			remove_element()
> 			{
> 				--pool->curr_nr;
> 			}
> 		}
> 	}
> }
>
> mempool_free()
> {
> 	if (pool->curr_nr < pool->min_nr) {
> 		// pool->wait.head is a stack address
> 		// wake_up() will try to access this invalid address
> 		// which leads to a kernel panic
> 		return;
> 		wake_up(&pool->wait);
> 	}
> }
>
> Fix:
> reinit conf->r1bio_pool.wait after assigning newpool.
>
> Signed-off-by: Wang Jinchao <wangjinchao600@xxxxxxxxx>
> ---
>   drivers/md/raid1.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Yu Kuai <yukuai3@xxxxxxxxxx>