diff options
| author | Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com> | 2026-05-30 15:14:11 +0000 |
|---|---|---|
| committer | Yu Kuai <yukuai@fygo.io> | 2026-05-31 19:09:19 +0800 |
| commit | 909d9dc3b5730c8ed7b764c68bc788342df2a07b (patch) | |
| tree | b15c74a2aa2deb400c25c98547f6cf6470a522de | |
| parent | 6e3b0b91334d1dfaa20ca55eac835f5945a3b7c8 (diff) | |
| download | linux-stable-909d9dc3b5730c8ed7b764c68bc788342df2a07b.tar.gz linux-stable-909d9dc3b5730c8ed7b764c68bc788342df2a07b.zip | |
raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path
In raid1_write_request(), each per-mirror loop iteration begins by
incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a
badblock within the requested range, the code jumps to err_handle
without dropping the reference taken for the current mirror.
err_handle's cleanup loop will only decrements for k < i and
r1_bio->bios[k] is non-NULL. The current slot is therefore skipped,
leaving its nr_pending reference leaked permanently. The reference
prevents the rdev from ever being removed, since raid1_remove_conf()
refuses to remove an rdev with nr_pending > 0.
Fix this by calling rdev_dec_pending() before jumping to err_handle.
Fixes: f2a38abf5f1c ("md/raid1: Atomic write support")
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Link: https://patch.msgid.link/20260530151411.4119-1-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
| -rw-r--r-- | drivers/md/raid1.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 85a17909d8fe..b1ed4cc6ade4 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1603,8 +1603,10 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, * complexity of supporting that is not worth * the benefit. */ - if (bio->bi_opf & REQ_ATOMIC) + if (bio->bi_opf & REQ_ATOMIC) { + rdev_dec_pending(rdev, mddev); goto err_handle; + } good_sectors = first_bad - r1_bio->sector; if (good_sectors < max_sectors) |