imsm: FIX: mdmon crash during 2 raid0 arrays expansion

When expansion is run on 2 raid0 arrays in container no update
is sent to mdmon because mdmon is off (mdadm performs update)
Memory size for first reshaped array is allocated to satisfy memory
requirements for expanded maps.
Memory for second device is allocated using old disks number, as in
metadata there is no information about this array reshape.
When mdmon initiates second array reshape it overwrites internal
structures and crashes). There is no place to keep expanded maps.
To avoid this situation during loading metadata, allocated memory
should be performed using the maximum used disks number in particular
container.

Signed-off-by: Adam Kwolek <adam.kwolek@intel.com>
Signed-off-by: NeilBrown <neilb@suse.de>

diff --git a/super-intel.c b/super-intel.c
index 0ab435523d67afdd69baf2594aff6f9c8f9ed72d..bc3e48df27cf110fd38fa27ca6bc4ef7620c7943 100644 (file)
--- a/super-intel.c
+++ b/super-intel.c
@@ -2471,6 +2471,7 @@ static int parse_raid_devices(struct intel_super *super)
        int i;
        struct imsm_dev *dev_new;
        size_t len, len_migr;
+       size_t max_len = 0;
        size_t space_needed = 0;
        struct imsm_super *mpb = super->anchor;
 
@@ -2486,7 +2487,11 @@ static int parse_raid_devices(struct intel_super *super)
                dv = malloc(sizeof(*dv));
                if (!dv)
                        return 1;
-               dev_new = malloc(len_migr);
+               if (max_len < len_migr)
+                       max_len = len_migr;
+               if (max_len > len_migr)
+                       space_needed += max_len - len_migr;
+               dev_new = malloc(max_len);
                if (!dev_new) {
                        free(dv);
                        return 1;