md/raid1: Fix stack memory use after return in raid1_reshape

In the Linux kernel, the following vulnerability has been resolved:

md/raid1: Fix stack memory use after return in raid1_reshape

In the raid1_reshape function, newpool is

allocated on the stack and assigned to conf->r1bio_pool.

This results in conf->r1bio_pool.wait.head pointing

to a stack address.

Accessing this address later can lead to a kernel panic.

Example access path:

raid1_reshape()

{

// newpool is on the stack

mempool_t newpool, oldpool;

// initialize newpool.wait.head to stack address

mempool_init(&newpool, ...);

conf->r1bio_pool = newpool;

}

raid1_read_request() or raid1_write_request()

{

alloc_r1bio()

{

mempool_alloc()

{

// if pool->alloc fails

remove_element()

{

--pool->curr_nr;

}

}

}

}

mempool_free()

{

if (pool->curr_nr < pool->min_nr) {

// pool->wait.head is a stack address

// wake_up() will try to access this invalid address

// which leads to a kernel panic

return;

wake_up(&pool->wait);

}

}

Fix:

reinit conf->r1bio_pool.wait after assigning newpool.