Abd-Alrhman Masalkhi d1eda529a4 md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry ...

[ Upstream commit 69ad6ce47f ]

When a read is retried, raid1_read_request() may be called with a
pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT
read, the bio is completed and the function returns immediately. In this
case the existing r1_bio is leaked.

This fixes a leak of pre-allocated r1_bio structures for retried reads.

Fixes: 5aa705039c ("md: raid1 add nowait support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260611083514.754922-1-abd.masalkhi@gmail.com?part=1
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Link: https://patch.msgid.link/20260611101350.759154-1-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-07-24 15:54:50 +02:00

..

accessibility

…

acpi

ACPI: IPMI: Fix inverted interface check in ipmi_bmc_gone()

2026-07-24 15:54:50 +02:00

amba

…

android

binder: fix UAF in binder_free_transaction()

2026-07-24 15:54:21 +02:00

ata

…

atm

…

auxdisplay

auxdisplay: line-display: fix OOB read on zero-length message_store()

2026-06-19 13:36:59 +02:00

base

firmware_loader: Fix recursive lock in device_cache_fw_images()

2026-07-24 15:54:40 +02:00

bcma

…

block

…

bluetooth

Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work()

2026-07-24 15:54:23 +02:00

bus

bus: mhi: ep: Fix potential deadlock in mhi_ep_reset_worker()

2026-07-24 15:54:45 +02:00

cdrom

…

char

char: tlclk: fix use-after-free in tlclk_cleanup()

2026-07-24 15:54:45 +02:00

clk

clk: qcom: a53: Corrected frequency multiplier for 1152MHz

2026-07-24 15:54:46 +02:00

clocksource

clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances

2026-07-24 15:54:24 +02:00

comedi

comedi: comedi_test: Fix limiting of convert_arg in waveform_ai_cmdtest()

2026-06-19 13:37:03 +02:00

connector

…

counter

counter: Fix refcount leak in counter_alloc() error path

2026-06-19 13:37:03 +02:00

cpufreq

cpufreq: conservative: Simplify frequency limit handling

2026-07-24 15:54:35 +02:00

cpuidle

…

crypto

crypto: cavium/cpt - fix DMA cleanup using wrong loop index

2026-07-24 15:54:42 +02:00

cxl

…

dax

dax/kmem: account for partial discontiguous resource upon removal

2026-07-24 15:54:37 +02:00

dca

…

devfreq

…

dio

…

dma

dmaengine: Fix possible use after free

2026-07-24 15:54:46 +02:00

dma-buf

udmabuf: fix DMA direction mismatch in release_udmabuf()

2026-07-24 15:54:29 +02:00

edac

EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info

2026-07-24 15:54:37 +02:00

eisa

…

extcon

…

firewire

…

firmware

firmware: arm_scmi: Fix OOB in scmi_power_name_get()

2026-07-24 15:54:35 +02:00

fpga

fpga: region: fix use-after-free in child_regions_with_firmware()

2026-07-04 13:41:32 +02:00

fsi

…

gnss

…

gpio

gpio: eic-sprd: use raw_spinlock_t in the irq startup path

2026-07-24 15:54:22 +02:00

gpu

drm/amdgpu: initialize irq.lock spinlock earlier

2026-07-24 15:54:49 +02:00

greybus

…

hid

HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter

2026-07-24 15:54:45 +02:00

hsi

…

hte

…

hv

Drivers: hv: vmbus: Improve the logic of reserving fb_mmio on Gen2 VMs

2026-07-04 13:41:33 +02:00

hwmon

hwmon: (pmbus/adm1266) serialize NVMEM blackbox read with pmbus_lock

2026-06-19 13:36:58 +02:00

hwspinlock

hwspinlock: qcom: avoid uninitialized struct members

2026-07-24 15:54:40 +02:00

hwtracing

coresight: etm4x: Correct TRCVMIDCCTLR1 save and restore

2026-07-24 15:54:44 +02:00

i2c

i2c: stm32f7: truncate clock period instead of rounding it

2026-07-24 15:54:29 +02:00

i3c

i3c: master: Prevent reuse of dynamic address on device add failure

2026-07-24 15:54:48 +02:00

idle

…

iio

iio: accel: mma8452: handle I2C read error(s) in mma8452_read()

2026-07-24 15:54:45 +02:00

infiniband

RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one

2026-07-24 15:54:41 +02:00

input

Input: maplecontrol - set driver data before registering input device

2026-07-24 15:54:30 +02:00

interconnect

…

iommu

iommu/amd: Fix a stale comment about which legacy mode is user visible

2026-07-24 15:54:34 +02:00

ipack

…

irqchip

irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

2026-07-04 13:41:32 +02:00

isdn

…

leds

…

macintosh

…

mailbox

mailbox: mtk-adsp: fix UAF during device teardown

2026-07-24 15:54:45 +02:00

mcb

…

md

md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry

2026-07-24 15:54:50 +02:00

media

media: qcom: venus: relax encoder frame/blur step size on v6

2026-07-24 15:54:37 +02:00

memory

…

memstick

…

message

…

mfd

mfd: cros_ec: Delay dev_set_drvdata() until probe success

2026-07-24 15:54:23 +02:00

misc

misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

2026-07-04 13:41:33 +02:00

mmc

mmc: sdhci: add signal voltage switch in sdhci_resume_host

2026-06-19 13:37:16 +02:00

most

…

mtd

mtd: spi-nor: Drop duplicate Kconfig dependency

2026-07-24 15:54:36 +02:00

mux

…

net

dpaa2-switch: fix VLAN upper check not rejecting bridge join

2026-07-24 15:54:49 +02:00

nfc

nfc: nxp-nci: i2c: use rising-edge IRQ on ACPI systems

2026-06-19 13:36:53 +02:00

ntb

NTB: epf: Fix request_irq() unwind in ntb_epf_init_isr()

2026-07-24 15:54:29 +02:00

nubus

…

nvdimm

nvdimm/btt: Handle preemption in BTT lane acquisition

2026-07-24 15:54:38 +02:00

nvme

nvme-multipath: fix flex array size in struct nvme_ns_head

2026-07-24 15:54:36 +02:00

nvmem

…

of

…

opp

…

parisc

…

parport

parport: Fix race between port and client registration

2026-06-19 13:37:00 +02:00

pci

PCI: iproc: Restore .map_irq() for the platform bus driver

2026-07-24 15:54:49 +02:00

pcmcia

…

peci

…

perf

…

phy

phy: phy-can-transceiver: Check driver match and driver data against NULL

2026-07-24 15:54:45 +02:00

pinctrl

pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39

2026-07-24 15:54:40 +02:00

platform

platform/x86: xo15-ebook: Fix wakeup source and GPE handling

2026-07-24 15:54:45 +02:00

pnp

…

power

power: supply: core: fix supplied_from allocations

2026-07-24 15:54:43 +02:00

powercap

…

pps

…

ps3

…

ptp

ptp: vclock: Switch from RCU to SRCU

2026-06-19 13:37:09 +02:00

pwm

pwm: imx27: Fix variable truncation in .apply()

2026-07-24 15:54:35 +02:00

rapidio

rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()

2026-07-24 15:54:37 +02:00

ras

…

regulator

regulator: core: fix locking in regulator_resolve_supply() error path

2026-07-04 13:41:28 +02:00

remoteproc

…

reset

…

rpmsg

rpmsg: char: Fix use-after-free on probe error path

2026-07-24 15:54:17 +02:00

rtc

…

s390

Revert "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()"

2026-06-01 17:39:34 +02:00

sbus

…

scsi

scsi: pm8001: Fix error code in non_fatal_log_show()

2026-07-24 15:54:38 +02:00

sh

…

siox

…

slimbus

slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

2026-07-24 15:54:16 +02:00

soc

…

soundwire

…

spi

spi: rpc-if: Use correct device for hardware reinitialization on resume

2026-07-24 15:54:49 +02:00

spmi

…

ssb

…

staging

staging: most: video: avoid double free on video register failure

2026-07-24 15:54:45 +02:00

target

scsi: target: Fix hexadecimal CHAP_I handling

2026-07-24 15:54:40 +02:00

tc

…

tee

tee: optee: prevent use-after-free when the client exits before the supplicant

2026-06-19 13:37:08 +02:00

thermal

thermal: intel: Fix dangling resources on thermal_throttle_online() failure

2026-07-24 15:54:49 +02:00

thunderbolt

thunderbolt: property: Cap recursion depth in __tb_property_parse_dir()

2026-06-19 13:37:29 +02:00

tty

serial: 8250_omap: clear rx_running on zero-length DMA completes

2026-07-24 15:54:32 +02:00

ufs

…

uio

…

usb

usb: host: max3421: Reject hub port requests for non-existent ports

2026-07-24 15:54:45 +02:00

vdpa

vduse: Requeue failed read to send_list head

2026-07-24 15:54:41 +02:00

vfio

vfio/pci: Release the VGA arbiter client on register_device() failure

2026-07-24 15:54:20 +02:00

vhost

vhost/net: complete zerocopy ubufs only once

2026-07-24 15:54:41 +02:00

video

fbdev: sm501fb: Fix buffer errors in OF binding code

2026-07-24 15:54:40 +02:00

virt

…

virtio

virtio_ring: introduce dma sync api for virtqueue

2026-07-24 15:54:49 +02:00

vlynq

…

w1

…

watchdog

watchdog: unregister PM notifier on watchdog unregister

2026-07-24 15:54:40 +02:00

xen

…

zorro

…

Kconfig

…

Makefile

…