Commit bd831c2b authored by Li Lingfeng's avatar Li Lingfeng
Browse files

md: use RCU lock to protect traversal in md_spares_need_change() 

mainline inclusion
from mainline-v6.9-rc1
commit 570b9147deb6b07b955b55e06c714ca12a5f3e16
bugzilla: https://gitee.com/openeuler/kernel/issues/IAZESX

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=570b9147deb6b07b955b55e06c714ca12a5f3e16



--------------------------------

Since md_start_sync() will be called without the protect of mddev_lock,
and it can run concurrently with array reconfiguration, traversal of rdev
in it should be protected by RCU lock.
Commit bc08041b32ab ("md: suspend array in md_start_sync() if array need
reconfiguration") added md_spares_need_change() to md_start_sync(),
casusing use of rdev without any protection.
Fix this by adding RCU lock in md_spares_need_change().

Fixes: bc08041b32ab ("md: suspend array in md_start_sync() if array need reconfiguration")
Cc: stable@vger.kernel.org # 6.7+
Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
Signed-off-by: default avatarSong Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20240104133629.1277517-1-lilingfeng@huaweicloud.com


Signed-off-by: default avatarLi Lingfeng <lilingfeng3@huawei.com>
parent 09350f59

drivers/md/md.c

+7 −2
Original line number Diff line number Diff line
@@ -9277,9 +9277,14 @@ static bool md_spares_need_change(struct mddev *mddev) 
{

	struct md_rdev *rdev;



	rdev_for_each(rdev, mddev)

		if (rdev_removeable(rdev) || rdev_addable(rdev))

	rcu_read_lock();

	rdev_for_each_rcu(rdev, mddev) {

		if (rdev_removeable(rdev) || rdev_addable(rdev)) {

			rcu_read_unlock();

			return true;

		}

	}

	rcu_read_unlock();

	return false;

}