From: Jonathan E Brassow <[email-masked]>

The dm-raid target is calling MD's bitmap_load function upon every
resume, but it is written only to be called once.  Otherwise, it
allocates new memory for the bitmap without freeing the old and
increments the number of pages it thinks it has without zeroing first.
This ultimately leads to access beyond allocated memory and lost memory.

Simply avoiding the bitmap_load call when resuming is not sufficient
because if the target was suspended while the initial recovery was only
partially complete, it needs to be restarted.

So use 'md_wakeup_thread' instead in this case.

Signed-off-by: Jonathan Brassow <[email-masked]>
Signed-off-by: Alasdair G Kergon <[email-masked]>

---
 drivers/md/dm-raid.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

Index: linux-3.3-rc2/drivers/md/dm-raid.c
===================================================================
--- linux-3.3-rc2.orig/drivers/md/dm-raid.c
+++ linux-3.3-rc2/drivers/md/dm-raid.c
@@ -56,7 +56,8 @@ struct raid_dev {
 struct raid_set {
 	struct dm_target *ti;
 
-	uint64_t print_flags;
+	uint32_t bitmap_loaded;
+	uint32_t print_flags;
 
 	struct mddev md;
 	struct raid_type *raid_type;
@@ -1085,7 +1086,7 @@ static int raid_status(struct dm_target 
 				raid_param_cnt += 2;
 		}
 
-		raid_param_cnt += (hweight64(rs->print_flags & ~DMPF_REBUILD) * 2);
+		raid_param_cnt += (hweight32(rs->print_flags & ~DMPF_REBUILD) * 2);
 		if (rs->print_flags & (DMPF_SYNC | DMPF_NOSYNC))
 			raid_param_cnt--;
 
@@ -1197,7 +1198,12 @@ static void raid_resume(struct dm_target
 {
 	struct raid_set *rs = ti->private;
 
-	bitmap_load(&rs->md);
+	if (!rs->bitmap_loaded) {
+		bitmap_load(&rs->md);
+		rs->bitmap_loaded = 1;
+	} else
+		md_wakeup_thread(rs->md.thread);
+
 	mddev_resume(&rs->md);
 }