Re: [PATCH 3/3] md/raid10: Don't free conf on raid10_run failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] md/raid10: NULL ptr deref and I/O hang on raid10_run failure
--

commit 1bebf502d0ba7be4661dc272d82091e48c0924ff
Author: Zhihao Cheng <chengzhihao1@huawei.com>

md/raid10: Don't free conf on raid10_run failure

This patch prevents freeing the configuration on raid10_run() failure to
avoid a null pointer dereference later during shutdown. It modifies the
failure path to skip raid10_free_conf() and clearing mddev->private, leaving
the conf structure allocated.

> diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
> index 1093c798d9dde..9e4d4202f35cf 100644
> --- a/drivers/md/raid10.c
> +++ b/drivers/md/raid10.c
[ ... ]
> @@ -4106,10 +4106,8 @@ static int raid10_run(struct mddev *mddev)
>  
>  	return 0;
>  
> -out_free_conf:
> +out_unregister_thread:
>  	md_unregister_thread(mddev, &mddev->thread);
> -	raid10_free_conf(conf);
> -	mddev->private = NULL;

[Severity: High]
Does leaving mddev->private allocated here expose the array to panics and
I/O hangs when raid10_run() fails?

Since the sysfs interface ignores personality run() failures:

drivers/md/md.c:level_store() {
    ...
    pers->run(mddev);
    ...
}

The array remains pseudo-active. If subsequent I/O requests enter
raid10_make_request(), they can hang indefinitely because they attempt
to wake a NULL thread:

drivers/md/raid10.c:raid10_make_request() {
    ...
    bio_list_add(&conf->pending_bio_list, mbio);
    spin_unlock_irqrestore(&conf->device_lock, flags);
    md_wakeup_thread(mddev->thread);
    ...
}

Furthermore, if a concurrent teardown or flush raises conf->barrier,
wait_barrier() will call stop_waiting_barrier(), which unconditionally
dereferences the NULL thread pointer, causing a panic:

drivers/md/raid10.c:stop_waiting_barrier() {
    ...
    if (thread->tsk == current) {
    ...
}

>  out:
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921071537.2902362-1-chengzhihao1@huawei.com?part=3