Re: [PATCH 6.6.y] md/raid0: fix data corruption when chunk size is below PAGE_SIZE

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] md: missing queue freeze before blk_queue_chunk_sectors()
--

commit b6776719727e7cf128eed60b1bbe45a3b0836f15
Author: YunyeZhao <yunye.zhao@linux.alibaba.com>

md/raid0: fix data corruption when chunk size is below PAGE_SIZE

Fixes silent data corruption that occurs when bios spanning multiple RAID0
chunks are not split properly by the block layer. Sets the chunk boundary
after stacking member limits to ensure block-layer bio splitting respects
the RAID0 chunk size.

> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index c50a7abda744a..5a57e327c6ba4 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
[ ... ]
> @@ -413,6 +415,18 @@ static int raid0_run(struct mddev *mddev)
>  			disk_stack_limits(mddev->gendisk, rdev->bdev,
>  					  rdev->data_offset << 9);
>  		}
> +
> +		/*
> +		 * Set the chunk boundary after stacking member limits, which
> +		 * may clear or reduce it. Without it a bio may span several
> +		 * chunks when chunk size < PAGE_SIZE. Keep it a multiple of
> +		 * the logical block size so the block layer can split at it.
> +		 */
> +		chunk_limit = gcd(mddev->queue->limits.chunk_sectors,
> +				  mddev->chunk_sectors);
> +		if (!(chunk_limit %
> +		      (mddev->queue->limits.logical_block_size >> SECTOR_SHIFT)))
> +			blk_queue_chunk_sectors(mddev->queue, chunk_limit);

[Severity: High]
Could modifying the block queue limits here without freezing the queue expose
the block layer to torn limit reads?

When an array is reconfigured, raid0_run() is invoked to update limits. While
mddev_suspend() is used during reconfiguration, it only drains
mddev->active_io, which pauses bios deep in the MD stack at
md_handle_request().

It does not prevent new bios from entering the generic block layer via
submit_bio_noacct() and executing blk_queue_split(). Because the queue is not
frozen via blk_mq_freeze_queue(), these concurrent bios might read torn
values of q->limits.chunk_sectors while raid0_run() modifies it, potentially
leading to inconsistent splitting and silent data corruption.

>  	}
>  
>  	/* calculate array device size */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013133243.42145-1-yunye.zhao@linux.alibaba.com?part=1