Commit 04b857f7 authored by NeilBrown's avatar NeilBrown Committed by Linus Torvalds

[PATCH] md: Fix several raid1 bugs which cause a memory leak

- wrong test for 'is this a BARRIER bio'
- not freeing on all possible paths.
- using r1_bio after freeing it.
Signed-off-by: default avatarNeil Brown <neilb@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 628de616
...@@ -306,6 +306,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int ...@@ -306,6 +306,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private); r1bio_t * r1_bio = (r1bio_t *)(bio->bi_private);
int mirror, behind = test_bit(R1BIO_BehindIO, &r1_bio->state); int mirror, behind = test_bit(R1BIO_BehindIO, &r1_bio->state);
conf_t *conf = mddev_to_conf(r1_bio->mddev); conf_t *conf = mddev_to_conf(r1_bio->mddev);
struct bio *to_put = NULL;
if (bio->bi_size) if (bio->bi_size)
return 1; return 1;
...@@ -323,6 +324,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int ...@@ -323,6 +324,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
* this branch is our 'one mirror IO has finished' event handler: * this branch is our 'one mirror IO has finished' event handler:
*/ */
r1_bio->bios[mirror] = NULL; r1_bio->bios[mirror] = NULL;
to_put = bio;
if (!uptodate) { if (!uptodate) {
md_error(r1_bio->mddev, conf->mirrors[mirror].rdev); md_error(r1_bio->mddev, conf->mirrors[mirror].rdev);
/* an I/O failed, we can't clear the bitmap */ /* an I/O failed, we can't clear the bitmap */
...@@ -375,7 +377,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int ...@@ -375,7 +377,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
/* Don't dec_pending yet, we want to hold /* Don't dec_pending yet, we want to hold
* the reference over the retry * the reference over the retry
*/ */
return 0; goto out;
} }
if (test_bit(R1BIO_BehindIO, &r1_bio->state)) { if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
/* free extra copy of the data pages */ /* free extra copy of the data pages */
...@@ -392,10 +394,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int ...@@ -392,10 +394,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
raid_end_bio_io(r1_bio); raid_end_bio_io(r1_bio);
} }
if (r1_bio->bios[mirror]==NULL)
bio_put(bio);
rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev); rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
out:
if (to_put)
bio_put(to_put);
return 0; return 0;
} }
...@@ -857,7 +860,7 @@ static int make_request(request_queue_t *q, struct bio * bio) ...@@ -857,7 +860,7 @@ static int make_request(request_queue_t *q, struct bio * bio)
atomic_set(&r1_bio->remaining, 0); atomic_set(&r1_bio->remaining, 0);
atomic_set(&r1_bio->behind_remaining, 0); atomic_set(&r1_bio->behind_remaining, 0);
do_barriers = bio->bi_rw & BIO_RW_BARRIER; do_barriers = bio_barrier(bio);
if (do_barriers) if (do_barriers)
set_bit(R1BIO_Barrier, &r1_bio->state); set_bit(R1BIO_Barrier, &r1_bio->state);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment