Re: [PATCH v2 2/4] md/raid10: fix writes_pending leak on write request failures

["yu kuai" <yukuai@fygo.io>]

Hi,

在 2026/6/14 2:40, sashiko-bot@kernel.org 写道:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
>
> Pre-existing issues:
> - [High] The `r10_bio` structure allocated from the mempool is leaked when `raid10_write_request()` bails out early due to `REQ_NOWAIT`.
> --
This looks like a real issue, do you plan to fix this as well?
>
> commit 3940ccdb4c7c7e19c20f9b5e2e1d12545c2558b5
> Author: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
>
> md/raid10: fix writes_pending leak on write request failures
>
> raid10_make_request() acquires a writes_pending reference with
> md_write_start() before dispatching write requests. Several failure
> paths in raid10_write_request() complete the bio and return without
> reaching the normal write completion path, causing the corresponding
> md_write_end() to be skipped.
>
>> diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
>> index cee5a253a281d..c123a8c76ddcd 100644
>> --- a/drivers/md/raid10.c
>> +++ b/drivers/md/raid10.c
> [ ... ]
>> @@ -1365,7 +1365,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
>>   		/* Bail out if REQ_NOWAIT is set for the bio */
>>   		if (bio->bi_opf & REQ_NOWAIT) {
>>   			bio_wouldblock_error(bio);
>> -			return;
>> +			return false;
> [Severity: High]
> This isn't a bug introduced by this patch, but does this early return leak
> the r10_bio structure?
>
> __make_request() allocates r10_bio using:
>      r10_bio = mempool_alloc(&conf->r10bio_pool, GFP_NOIO);
>
> It then passes it to raid10_write_request(). When the bio has REQ_NOWAIT set
> during a clustered area resync, we complete the bio with an error and return
> false without freeing the r10_bio. Could repeatedly triggering this exhaust
> the r10bio_pool, causing deadlocks on subsequent operations?
>
> Note that the regular_request_wait() error path right below correctly calls
> free_r10bio(r10_bio) before returning.
>
>>   		}
>>   		for (;;) {
> [ ... ]
>> @@ -1398,7 +1398,7 @@ static void raid10_write_request(struct mddev *mddev, struct bio *bio,
>>   		if (bio->bi_opf & REQ_NOWAIT) {
>>   			allow_barrier(conf);
>>   			bio_wouldblock_error(bio);
>> -			return;
>> +			return false;
> [Severity: High]
> This is a pre-existing issue, but does this path also leak the r10_bio
> mempool allocation when waiting for a reshape metadata update?
>
> Similar to the clustered area resync case above, the r10_bio allocated in
> __make_request() does not appear to be freed before returning here.
>
>>   		}
>>   		mddev_add_trace_msg(conf->mddev,

-- 
Thanks,
Kuai