diff options
| author | Chen Cheng <chencheng@fnnas.com> | 2026-07-11 18:03:52 +0800 |
|---|---|---|
| committer | Yu Kuai <yukuai@fygo.io> | 2026-07-31 05:42:00 +0800 |
| commit | fe8d6b0187469c91d57dbc25ece5b503bfb3bc26 (patch) | |
| tree | dc3a1b8647d4172724f41164a12de693ac9eef86 | |
| parent | 8e9171decb5ed5c3fe0430a559f45ca556e94d26 (diff) | |
md/raid10: free r10bio before ending master_bio in raid_end_bio_io() and raid_end_discard_bio()
origin flow:
bio_endio(master_bio); /* may drop active_io to zero */
allow_barrier(conf);
free_r10bio(r10_bio); /* reads conf->geo, returns to pool */
one scenario is:
CPU A (softirq, raid_end_bio_io) CPU B (action_store) --> reshape
================================ ===============================
bio_endio(master_bio)
md_end_clone_io
percpu_ref_put -> 0
wait_event wakeup, and,
mddev_suspend return
raid10_start_reshape:
setup_geo(&conf->geo, new)
...
mempool_destroy(old_pool)
conf->r10bio_pool = new_pool
allow_barrier(conf)
free_r10bio(r10_bio)
put_all_bios:
for (i=0; i<conf->geo.raid_disks; i++)
==> old obj, new geo, OOB
mempool_free(r10_bio, conf->r10bio_pool)
==> old-geometry obj freed into new pool
so .. fix by reorder the flow:
free_r10bio(r10_bio)
bio_endio(master_bio)
allow_barrier(conf)
raid_end_discard_bio() is exactly the same.
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Link: https://patch.msgid.link/20260711100352.425177-4-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
| -rw-r--r-- | drivers/md/raid10.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 3f2da07676e7..ed3c6fbe65f7 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -331,20 +331,24 @@ static void raid_end_bio_io(struct r10bio *r10_bio) { struct bio *bio = r10_bio->master_bio; struct r10conf *conf = r10_bio->mddev->private; + bool returned = true; if (!test_and_set_bit(R10BIO_Returned, &r10_bio->state)) { if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) bio->bi_status = BLK_STS_IOERR; - bio_endio(bio); + returned = false; } + free_r10bio(r10_bio); + + if (!returned) + bio_endio(bio); + /* * Wake up any possible resync thread that waits for the device * to go idle. */ allow_barrier(conf); - - free_r10bio(r10_bio); } /* @@ -1537,9 +1541,11 @@ static void raid_end_discard_bio(struct r10bio *r10bio) free_r10bio(r10bio); r10bio = first_r10bio; } else { + struct bio *master_bio = r10bio->master_bio; + md_write_end(r10bio->mddev); - bio_endio(r10bio->master_bio); free_r10bio(r10bio); + bio_endio(master_bio); break; } } |