[PATCH 1/2] md/raid5: fix pool_size leak in resize_stripes error path

[ghuicao]

From: Cao Guanghui <caoguanghui@xxxxxxxxxx>

In resize_stripes(), conf->disks is replaced with a new array (ndisks)
in Step 3, but pool_size is only updated at the end with
"if (!err) conf->pool_size = newsize".  If Step 4 (allocating pages for
new stripes) fails, err is set but pool_size is not updated, even though
conf->disks already has newsize entries.

When the array is later torn down, free_conf() iterates only pool_size
(= old value) entries, leaking (newsize - pool_size) extra_page
allocations.

Set pool_size immediately after replacing conf->disks, so it always
matches the actual array size regardless of subsequent failures.

Fixes: ad01c9e3752f ("[PATCH] md: Allow stripes to be expanded in preparation for expanding an array")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Cao Guanghui <caoguanghui@xxxxxxxxxx>
---
 drivers/md/raid5.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2641,6 +2641,7 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 		} else {
 			kfree(conf->disks);
 			conf->disks = ndisks;
+			conf->pool_size = newsize;
 		}
 	} else
 		err = -ENOMEM;
@@ -2687,5 +2688,3 @@ static int resize_stripes(struct r5conf *conf, int newsize)
 	/* critical section pass, GFP_NOIO no longer needed */
 
-	if (!err)
-		conf->pool_size = newsize;
 	mutex_unlock(&conf->cache_size_mutex);
-- 
2.34.1