[PATCH v3] md: do not _put wrong device in md_seq_next

[PATCH v3] md: do not _put wrong device in md_seq_next

[Mariusz Tkaczyk]

If there are multiple arrays in system and one mddevice is marked
with MD_DELETED and md_seq_next() is called in the middle of removal
then it _get()s proper device but it may _put() deleted one. As a result,
active counter may never be zeroed for mddevice and it cannot
be removed.

Put the device which has been _get with previous md_seq_next() call.

Cc: Yu Kuai <yukuai3@huawei.com>
Fixes: 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed")
Reported-by: AceLan Kao <acelan@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217798

Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
---
 drivers/md/md.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0fe7ab6e8ab9..b8f232840f7c 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 	spin_unlock(&all_mddevs_lock);
 
 	if (to_put)
-		mddev_put(mddev);
+		mddev_put(to_put);
 	return next_mddev;
 
 }
-- 
2.26.2

Re: [PATCH v3] md: do not _put wrong device in md_seq_next

[Song Liu]

On Thu, Sep 14, 2023 at 8:24 AM Mariusz Tkaczyk
<mariusz.tkaczyk@linux.intel.com> wrote:
>
> If there are multiple arrays in system and one mddevice is marked
> with MD_DELETED and md_seq_next() is called in the middle of removal
> then it _get()s proper device but it may _put() deleted one. As a result,
> active counter may never be zeroed for mddevice and it cannot
> be removed.
>
> Put the device which has been _get with previous md_seq_next() call.
>
> Cc: Yu Kuai <yukuai3@huawei.com>
> Fixes: 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed")
> Reported-by: AceLan Kao <acelan@gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217798
>
> Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>

Applied to md-fixes, with minor changes in the commit log.

Thanks,
Song

> ---
>  drivers/md/md.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 0fe7ab6e8ab9..b8f232840f7c 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -8256,7 +8256,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos)
>         spin_unlock(&all_mddevs_lock);
>
>         if (to_put)
> -               mddev_put(mddev);
> +               mddev_put(to_put);
>         return next_mddev;
>
>  }
> --
> 2.26.2
>