Re: fsync() on read-only RAID triggers BUG

[Sebastian Riemer <sebastian.riemer@profitbricks.com>]

[-- Attachment #1: Type: text/plain, Size: 724 bytes --]

On 20.01.2013 19:44, Ben Hutchings wrote:
> # Call fsync()
> python -c "import os; os.fsync(os.open('/dev/md0', os.O_RDWR))"
> --- END ---
> 
> I assume that the sync request should be filtered out at some point
> before this assertion is made, since there can be nothing to sync.
> 

I wrote a test case in C. It gets SIGSEGV upon fsync. When making the
rdevs below also read-only the MD device can't be stopped anymore as it
thinks that there is still active IO.

The attached patch should fix it. Please confirm. We have to return a
completion without incrementing the active IO count. Error code -EROFS
seems to be suited best.

But the libc fsync gets -EIO anyway:
Input/output error

Any objection?

Cheers,
Sebastian

[-- Attachment #2: 0001-md-protect-against-crash-upon-fsync-on-ro-array.txt --]
[-- Type: text/plain, Size: 1066 bytes --]

From fe0357344877c9b9cc623fd582a4e0670e448317 Mon Sep 17 00:00:00 2001
From: Sebastian Riemer <sebastian.riemer@profitbricks.com>
Date: Fri, 25 Jan 2013 12:46:59 +0100
Subject: [PATCH] md: protect against crash upon fsync on ro array

If an fsync occurrs on a read-only array, we need to send a
completion for the IO and may not increment the active IO count.
Otherwise, we hit a bug trace and can't stop the MD array anymore.

As return value -EROFS makes most sense.

Signed-off-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
---
 drivers/md/md.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3db3d1b..475e0be 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -322,6 +322,11 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
 		}
 		finish_wait(&mddev->sb_wait, &__wait);
 	}
+	if (mddev->ro == 1 && unlikely(rw == WRITE)) {
+		rcu_read_unlock();
+		bio_endio(bio, -EROFS);
+		return;
+	}
 	atomic_inc(&mddev->active_io);
 	rcu_read_unlock();
 
-- 
1.7.1