[PATCH 6.6.y] md/raid0: fix data corruption when chunk size is below PAGE_SIZE

[PATCH 6.6.y] md/raid0: fix data corruption when chunk size is below PAGE_SIZE

[Yunye Zhao]

From: YunyeZhao <yunye.zhao@linux.alibaba.com>

Commit 319ff40a5427 ("md/raid0: Fix performance regression for large sequential writes")
assumes that bios reaching RAID0 are no larger than the chunk size.

However, blk_queue_max_hw_sectors() raises limits smaller than
PAGE_SIZE to one page. With 64 KiB pages and a 16 KiB RAID0 chunk, a
bio can therefore span several chunks. raid0_make_request() splits it
only once and maps the multi-chunk remainder to one member device,
causing silent data corruption.

Set the queue chunk boundary after stacking the member limits, combined
with any inherited boundary using gcd(). This makes the block layer
split bios at chunk boundaries before they reach RAID0. Only install a
boundary aligned to the logical block size so that bio splitting
always makes progress.

Setting the boundary after disk_stack_limits() is required because
stacking may clear or reduce a boundary installed earlier. This adapts
the mechanism introduced by upstream commit 4b8beba60d32
("md/raid0: set chunk_sectors limit") to the queue limits API used by
6.6.y.

The corruption was reproduced on arm64 with 64 KiB pages and a 16 KiB
chunk. A 64 KiB chunk configuration is unaffected.

Fixes: 319ff40a5427 ("md/raid0: Fix performance regression for large sequential writes")
Signed-off-by: YunyeZhao <yunye.zhao@linux.alibaba.com>
---
 drivers/md/raid0.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index c50a7abda744..5a57e327c6ba 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -11,6 +11,7 @@
 */
 
 #include <linux/blkdev.h>
+#include <linux/gcd.h>
 #include <linux/seq_file.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -382,6 +383,7 @@ static void raid0_free(struct mddev *mddev, void *priv)
 static int raid0_run(struct mddev *mddev)
 {
 	struct r0conf *conf;
+	unsigned int chunk_limit;
 	int ret;
 
 	if (mddev->chunk_sectors == 0) {
@@ -413,6 +415,18 @@ static int raid0_run(struct mddev *mddev)
 			disk_stack_limits(mddev->gendisk, rdev->bdev,
 					  rdev->data_offset << 9);
 		}
+
+		/*
+		 * Set the chunk boundary after stacking member limits, which
+		 * may clear or reduce it. Without it a bio may span several
+		 * chunks when chunk size < PAGE_SIZE. Keep it a multiple of
+		 * the logical block size so the block layer can split at it.
+		 */
+		chunk_limit = gcd(mddev->queue->limits.chunk_sectors,
+				  mddev->chunk_sectors);
+		if (!(chunk_limit %
+		      (mddev->queue->limits.logical_block_size >> SECTOR_SHIFT)))
+			blk_queue_chunk_sectors(mddev->queue, chunk_limit);
 	}
 
 	/* calculate array device size */
-- 
2.19.1.6.gb485710b

Re: [PATCH 6.6.y] md/raid0: fix data corruption when chunk size is below PAGE_SIZE

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] md: missing queue freeze before blk_queue_chunk_sectors()
--

commit b6776719727e7cf128eed60b1bbe45a3b0836f15
Author: YunyeZhao <yunye.zhao@linux.alibaba.com>

md/raid0: fix data corruption when chunk size is below PAGE_SIZE

Fixes silent data corruption that occurs when bios spanning multiple RAID0
chunks are not split properly by the block layer. Sets the chunk boundary
after stacking member limits to ensure block-layer bio splitting respects
the RAID0 chunk size.

> diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
> index c50a7abda744a..5a57e327c6ba4 100644
> --- a/drivers/md/raid0.c
> +++ b/drivers/md/raid0.c
[ ... ]
> @@ -413,6 +415,18 @@ static int raid0_run(struct mddev *mddev)
>  			disk_stack_limits(mddev->gendisk, rdev->bdev,
>  					  rdev->data_offset << 9);
>  		}
> +
> +		/*
> +		 * Set the chunk boundary after stacking member limits, which
> +		 * may clear or reduce it. Without it a bio may span several
> +		 * chunks when chunk size < PAGE_SIZE. Keep it a multiple of
> +		 * the logical block size so the block layer can split at it.
> +		 */
> +		chunk_limit = gcd(mddev->queue->limits.chunk_sectors,
> +				  mddev->chunk_sectors);
> +		if (!(chunk_limit %
> +		      (mddev->queue->limits.logical_block_size >> SECTOR_SHIFT)))
> +			blk_queue_chunk_sectors(mddev->queue, chunk_limit);

[Severity: High]
Could modifying the block queue limits here without freezing the queue expose
the block layer to torn limit reads?

When an array is reconfigured, raid0_run() is invoked to update limits. While
mddev_suspend() is used during reconfiguration, it only drains
mddev->active_io, which pauses bios deep in the MD stack at
md_handle_request().

It does not prevent new bios from entering the generic block layer via
submit_bio_noacct() and executing blk_queue_split(). Because the queue is not
frozen via blk_mq_freeze_queue(), these concurrent bios might read torn
values of q->limits.chunk_sectors while raid0_run() modifies it, potentially
leading to inconsistent splitting and silent data corruption.

>  	}
>  
>  	/* calculate array device size */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013133243.42145-1-yunye.zhao@linux.alibaba.com?part=1