Skip to contentSkip to conversation

md: do not _put wrong device in md_seq_next

PATCH Applied Mariusz Tkaczyk 2 participants 2 messages Sep 14, 2023 MD RAID

lore
Share & tools
lore

Mariusz Tkaczyk

author
#0 lore raw

PATCH v3 1/1 md: do not _put wrong device in md_seq_next

If there are multiple arrays in system and one mddevice is marked with MD_DELETED and md_seq_next() is called in the middle of removal then it _get()s proper device but it may _put() deleted one. As a result, active counter may never be zeroed for mddevice and it cannot be removed.

Put the device which has been _get with previous md_seq_next() call.

Cc Yu Kuai <[email protected]>
Fixes 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed")
Reported-by AceLan Kao <[email protected]>
Closes https://bugzilla.kernel.org/show_bug.cgi?id=217798
Signed-off-by Mariusz Tkaczyk <[email protected]>
---
 drivers/md/md.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -1
index 0fe7ab6e8ab9..b8f232840f7c 100644
@@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 	spin_unlock(&all_mddevs_lock);
 
 	if (to_put)
-		mddev_put(mddev);
+		mddev_put(to_put);
 	return next_mddev;
 
 }
Signature · 1 line
2.26.2
maintainer Applied
#1 lore raw
Quoted 7 lines · Mariusz Tkaczyk

If there are multiple arrays in system and one mddevice is marked with MD_DELETED and md_seq_next() is called in the middle of removal then it _get()s proper device but it may _put() deleted one. As a result, active counter may never be zeroed for mddevice and it cannot be removed.

Quoted 8 lines

Put the device which has been _get with previous md_seq_next() call.

Cc Yu Kuai <[email protected]>
Fixes 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed")
Reported-by AceLan Kao <[email protected]>
Closes https://bugzilla.kernel.org/show_bug.cgi?id=217798
Signed-off-by Mariusz Tkaczyk <[email protected]>

Applied to md-fixes, with minor changes in the commit log.

Thanks,
Song

Quoted 20 lines
---
 drivers/md/md.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/md.c +1 -2
index 0fe7ab6e8ab9..b8f232840f7c 100644
@@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos)
        spin_unlock(&all_mddevs_lock);
 
        if (to_put)
-               mddev_put(mddev);
+               mddev_put(to_put);
        return next_mddev;
 
 }
--

2.26.2