| Message ID | 20230914152416.10819-1-mariusz.tkaczyk@linux.intel.com (mailing list archive) |
|---|---|
| State | Accepted, archived |
| Headers | show |
| Series | [v3] md: do not _put wrong device in md_seq_next | expand |
On Thu, Sep 14, 2023 at 8:24 AM Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> wrote: > > If there are multiple arrays in system and one mddevice is marked > with MD_DELETED and md_seq_next() is called in the middle of removal > then it _get()s proper device but it may _put() deleted one. As a result, > active counter may never be zeroed for mddevice and it cannot > be removed. > > Put the device which has been _get with previous md_seq_next() call. > > Cc: Yu Kuai <yukuai3@huawei.com> > Fixes: 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed") > Reported-by: AceLan Kao <acelan@gmail.com> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217798 > > Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> Applied to md-fixes, with minor changes in the commit log. Thanks, Song > --- > drivers/md/md.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/md/md.c b/drivers/md/md.c > index 0fe7ab6e8ab9..b8f232840f7c 100644 > --- a/drivers/md/md.c > +++ b/drivers/md/md.c > @@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) > spin_unlock(&all_mddevs_lock); > > if (to_put) > - mddev_put(mddev); > + mddev_put(to_put); > return next_mddev; > > } > -- > 2.26.2 >
diff --git a/drivers/md/md.c b/drivers/md/md.c index 0fe7ab6e8ab9..b8f232840f7c 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) spin_unlock(&all_mddevs_lock); if (to_put) - mddev_put(mddev); + mddev_put(to_put); return next_mddev; }
If there are multiple arrays in system and one mddevice is marked with MD_DELETED and md_seq_next() is called in the middle of removal then it _get()s proper device but it may _put() deleted one. As a result, active counter may never be zeroed for mddevice and it cannot be removed. Put the device which has been _get with previous md_seq_next() call. Cc: Yu Kuai <yukuai3@huawei.com> Fixes: 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed") Reported-by: AceLan Kao <acelan@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217798 Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com> --- drivers/md/md.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)