[PATCH 1/2] imsm: FIX: mdmon crash during 2 raid0 arrays expansion

When expansion is run on 2 raid0 arrays in container no update
is sent to mdmon because mdmon is off (mdadm performs update)
Memory size for first reshaped array is allocated to satisfy memory
requirements for expanded maps.
Memory for second device is allocated using old disks number, as in metadata
there is no information about this array reshape.
When mdmon initiates second array reshape it overwrites internal structures
and crashes). There is no place to keep expanded maps.
To avoid this situation during loading metadata, allocated memory should be performed
using the maximum used disks number in particular container.

Signed-off-by: Adam Kwolek
---

super-intel.c | 7 ++++++-
1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/super-intel.c b/super-intel.c
index 3e163ec..0c988d6 100644
--- a/super-intel.c
+++ b/super-intel.c
@@ -2483,6 +2483,7 @@ static int parse_raid_devices(struct intel_super *super)
int i;
struct imsm_dev *dev_new;
size_t len, len_migr;
+ size_t max_len = 0;
size_t space_needed = 0;
struct imsm_super *mpb = super->anchor;

@@ -2498,7 +2499,11 @@ static int parse_raid_devices(struct intel_super *super)
dv = malloc(sizeof(*dv));
if (!dv)
return 1;
- dev_new = malloc(len_migr);
+ if (max_len < len_migr)
+ max_len = len_migr;
+ if (max_len > len_migr)
+ space_needed += max_len - len_migr;
+ dev_new = malloc(max_len);
if (!dev_new) {
free(dv);
return 1;

--
To unsubscribe from this list: send the line "unsubscribe linux-raid" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html