[PATCH V2 0/2] md/raid10: annotate lockless access and fix hungtask

[PATCH V2 0/2] md/raid10: annotate lockless access and fix hungtask

[Zizhi Wo]

Patch 1 annotates the lockless access to conf->array_freeze_pending with
READ_ONCE()/WRITE_ONCE(). No functional change.

Patch 2 fixes a hungtask in raid10.

Changes in v2:
- Add patch 1 to annotate the lockless reads of conf->array_freeze_pending
  with READ_ONCE(), paried with WRITE_ONCE() on the write side.
- Use READ_ONCE() when reading conf->array_freeze_pending in patch 2.

v1:
https://lore.kernel.org/all/20260810135521.3470422-1-wozizhi@huaweicloud.com/

Zizhi Wo (2):
  md/raid10: annotate lockless access to array_freeze_pending
  md/raid10: fix missing wakeup in wait_barrier_nolock

 drivers/md/raid10.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

-- 
2.52.0

[PATCH V2 1/2] md/raid10: annotate lockless access to array_freeze_pending

[Zizhi Wo]

conf->array_freeze_pending is updated under conf->resync_lock in
freeze_array(), but read locklessly in allow_barrier(). Annotate these
accesses with READ_ONCE()/WRITE_ONCE() to document the intentional lockless
access and to prevent load/store tearing or fusing by the compiler. No
functional change.

Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
---
 drivers/md/raid10.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 0a3cfdd3f5df..dc40110a6736 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1031,11 +1031,11 @@ static bool wait_barrier(struct r10conf *conf, bool nowait)
 }
 
 static void allow_barrier(struct r10conf *conf)
 {
 	if ((atomic_dec_and_test(&conf->nr_pending)) ||
-			(conf->array_freeze_pending))
+	    READ_ONCE(conf->array_freeze_pending))
 		wake_up_barrier(conf);
 }
 
 static void freeze_array(struct r10conf *conf, int extra)
 {
@@ -1050,16 +1050,16 @@ static void freeze_array(struct r10conf *conf, int extra)
 	 * Thus the number queued (nr_queued) plus this request (extra)
 	 * must match the number of pending IOs (nr_pending) before
 	 * we continue.
 	 */
 	write_seqlock_irq(&conf->resync_lock);
-	conf->array_freeze_pending++;
+	WRITE_ONCE(conf->array_freeze_pending, conf->array_freeze_pending + 1);
 	WRITE_ONCE(conf->barrier, conf->barrier + 1);
 	conf->nr_waiting++;
 	wait_event_barrier_cmd(conf, atomic_read(&conf->nr_pending) ==
 			conf->nr_queued + extra, flush_pending_writes(conf));
-	conf->array_freeze_pending--;
+	WRITE_ONCE(conf->array_freeze_pending, conf->array_freeze_pending - 1);
 	write_sequnlock_irq(&conf->resync_lock);
 }
 
 static void unfreeze_array(struct r10conf *conf)
 {
-- 
2.52.0

[PATCH V2 2/2] md/raid10: fix missing wakeup in wait_barrier_nolock

[Zizhi Wo]

[BUG]
Recently, our fuzz testing triggered a hungtask issue in RAID10:

INFO: task md0_raid10:1273 blocked for more than 120 seconds.
      Not tainted 7.2.0-rc6+ #94
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:md0_raid10      state:D stack:0     pid:1273  tgid:1273  ppid:2
Call Trace:
 <TASK>
 __schedule+0xdf9/0x5c90
 ? _raw_spin_unlock_irqrestore+0xe/0x40
 schedule+0x74/0x1f0
 raid10d.cold+0x7db/0x1992
 md_thread+0x1ce/0x3e0
 kthread+0x327/0x410
 ......

[CAUSE]
The root cause of the issue is as follows:
[read process1]			[read process2]			[raid10d]
raid10_make_request
...
 // nr_pending == 1
 atomic_inc(&conf->nr_pending)
...
raid10_end_read_request
 reschedule_retry
  md_wakeup_thread(mddev->thread)
				raid10_read_request
				 regular_request_wait
				  wait_barrier
				   wait_barrier_nolock
				    seq = read_seqbegin(&conf->resync_lock)
				    // nr_pending == 2
				    atomic_inc(&conf->nr_pending)
								raid10d
								 handle_read_error
								  freeze_array
								   write_seqlock_irq(&conf->resync_lock)
								   conf->array_freeze_pending++
								   WRITE_ONCE(conf->barrier, conf->barrier + 1)
								   conf->nr_waiting++
								   // nr_pending == 2, nr_queued == 0
								   wait_event_barrier_cmd
								    write_sequnlock_irq(&(conf)->resync_lock)
								    schedule	// hungtask!!
				    read_seqretry(&conf->resync_lock, seq)
				    // not wakeup because conf->nr_pending == 1
				    atomic_dec_and_test(&conf->nr_pending)
				   /* Hungtask will also occur here: since the barrier is non-zero,
				    * this I/O can never complete, so it can't call allow_barrier()
				    * to wake up the pending freeze_array(). */
				   wait_event_barrier(conf, stop_waiting_barrier(conf))

wait_barrier_nolock() speculatively increments nr_pending and, on a seqlock
retry, rolls it back with atomic_dec_and_test(). The wake fires only when
nr_pending reaches 0. This causes the freeze_array() in the aforementioned
raid10d flow to never be woken up.

[FIX]
Referring to allow_barrier(), this issue can be fixed by adding a wake-up
condition for "conf->array_freeze_pending" in wait_barrier_nolock().

Fixes: b9b083f9044a ("md/raid10: convert resync_lock to use seqlock")
Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
---
 drivers/md/raid10.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index dc40110a6736..8dadf13c2b4d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -994,11 +994,12 @@ static bool wait_barrier_nolock(struct r10conf *conf)
 
 	atomic_inc(&conf->nr_pending);
 	if (!read_seqretry(&conf->resync_lock, seq))
 		return true;
 
-	if (atomic_dec_and_test(&conf->nr_pending))
+	if (atomic_dec_and_test(&conf->nr_pending) ||
+	    READ_ONCE(conf->array_freeze_pending))
 		wake_up_barrier(conf);
 
 	return false;
 }
 
-- 
2.52.0

Re: [PATCH V2 2/2] md/raid10: fix missing wakeup in wait_barrier_nolock

[Abd-Alrhman Masalkhi]

On Mon, Aug 17, 2026 at 11:33 +0800, Zizhi Wo wrote:
> [BUG]
> Recently, our fuzz testing triggered a hungtask issue in RAID10:
>
> INFO: task md0_raid10:1273 blocked for more than 120 seconds.
>       Not tainted 7.2.0-rc6+ #94
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:md0_raid10      state:D stack:0     pid:1273  tgid:1273  ppid:2
> Call Trace:
>  <TASK>
>  __schedule+0xdf9/0x5c90
>  ? _raw_spin_unlock_irqrestore+0xe/0x40
>  schedule+0x74/0x1f0
>  raid10d.cold+0x7db/0x1992
>  md_thread+0x1ce/0x3e0
>  kthread+0x327/0x410
>  ......
>
> [CAUSE]
> The root cause of the issue is as follows:
> [read process1]			[read process2]			[raid10d]
> raid10_make_request
> ...
>  // nr_pending == 1
>  atomic_inc(&conf->nr_pending)
> ...
> raid10_end_read_request
>  reschedule_retry
>   md_wakeup_thread(mddev->thread)
> 				raid10_read_request
> 				 regular_request_wait
> 				  wait_barrier
> 				   wait_barrier_nolock
> 				    seq = read_seqbegin(&conf->resync_lock)
> 				    // nr_pending == 2
> 				    atomic_inc(&conf->nr_pending)
> 								raid10d
> 								 handle_read_error
> 								  freeze_array
> 								   write_seqlock_irq(&conf->resync_lock)
> 								   conf->array_freeze_pending++
> 								   WRITE_ONCE(conf->barrier, conf->barrier + 1)
> 								   conf->nr_waiting++
> 								   // nr_pending == 2, nr_queued == 0
> 								   wait_event_barrier_cmd
> 								    write_sequnlock_irq(&(conf)->resync_lock)
> 								    schedule	// hungtask!!
> 				    read_seqretry(&conf->resync_lock, seq)
> 				    // not wakeup because conf->nr_pending == 1
> 				    atomic_dec_and_test(&conf->nr_pending)
> 				   /* Hungtask will also occur here: since the barrier is non-zero,
> 				    * this I/O can never complete, so it can't call allow_barrier()
> 				    * to wake up the pending freeze_array(). */
> 				   wait_event_barrier(conf, stop_waiting_barrier(conf))
>
> wait_barrier_nolock() speculatively increments nr_pending and, on a seqlock
> retry, rolls it back with atomic_dec_and_test(). The wake fires only when
> nr_pending reaches 0. This causes the freeze_array() in the aforementioned
> raid10d flow to never be woken up.
>
> [FIX]
> Referring to allow_barrier(), this issue can be fixed by adding a wake-up
> condition for "conf->array_freeze_pending" in wait_barrier_nolock().
>
> Fixes: b9b083f9044a ("md/raid10: convert resync_lock to use seqlock")
> Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
> ---
>  drivers/md/raid10.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
> index dc40110a6736..8dadf13c2b4d 100644
> --- a/drivers/md/raid10.c
> +++ b/drivers/md/raid10.c
> @@ -994,11 +994,12 @@ static bool wait_barrier_nolock(struct r10conf *conf)
>  
>  	atomic_inc(&conf->nr_pending);
>  	if (!read_seqretry(&conf->resync_lock, seq))
>  		return true;
>  
> -	if (atomic_dec_and_test(&conf->nr_pending))
> +	if (atomic_dec_and_test(&conf->nr_pending) ||
> +	    READ_ONCE(conf->array_freeze_pending))
>  		wake_up_barrier(conf);
>  
>  	return false;
>  }
>  
> -- 
> 2.52.0
>
>

It looks good to me.
Reviewed-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>

-- 
Best Regards,
Abd-Alrhman