From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from va-2-46.ptr.blmpb.com (va-2-46.ptr.blmpb.com [209.127.231.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 12C201E7C12 for ; Sat, 11 Jul 2026 17:44:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.127.231.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783791851; cv=none; b=eMDYOv+r2gSd3gjMx4LDBtOVztLesJ4wpz0cxGl4if2GUkhm5AiMMybJlVNG6rrCHYRGRNgkz4GFRvshlwP9SmyfUTuV5p3u0uD5pZnbOyCZYGaj9ECMRbBITrZBL27PoAeG8lZxxRy+lj55Qg1c35YBflCkwXs+4cUJkUbrmXs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783791851; c=relaxed/simple; bh=QaebH4SY6lTCF+bYrqMBtdG86enntGMrHSa+tlLd8ZQ=; h=From:In-Reply-To:Subject:Message-Id:Content-Type:References:To:Cc: Date:Mime-Version; b=EcpI4lqfZfOZ9dLdlZu3RqdlB1pyJ59cRMBScAzTyINAdUcqxKTklHRsit3XdDkJ3VTxPLowNaZnRMFoU2rQRfiDHnUarhTbJyiK6kJjHJ758Xvb2XKc3LRMkzVRbdIp6vGcbTxptZ3XIvfq1BZeh7v7TmS+R3W2gY3TUhtnffA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=fygo.io; spf=pass smtp.mailfrom=fygo.io; dkim=pass (2048-bit key) header.d=fygo-io.20200929.dkim.larksuite.com header.i=@fygo-io.20200929.dkim.larksuite.com header.b=AmlcoIx5; arc=none smtp.client-ip=209.127.231.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=fygo.io Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=fygo.io Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=fygo-io.20200929.dkim.larksuite.com header.i=@fygo-io.20200929.dkim.larksuite.com header.b="AmlcoIx5" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=s1; d=fygo-io.20200929.dkim.larksuite.com; t=1783791836; h=from:subject:mime-version:from:date:message-id:subject:to:cc: reply-to:content-type:mime-version:in-reply-to:message-id; bh=wE45Zi//ngGG2zCjWxjDU+BeRdl7JaQqgxT2QqPzchI=; b=AmlcoIx5kD08JGUvyAh23+uf5pNwpTxJhvEp4Ou6KpKtxvPVkOSsyHlCs9dslVsi2ljBtd UhUdRYg89DvruTF46wyWmESBkcBF7Ue5OZjPYsWWEWgANRVQ7IJlkIUZUjxT3Bl8y0Tewf 7/TPa0gXRfP/QAp/bmh0vCNvvo4RRjNX89wVz/WrTacAO6RTxrcufanBeKdv+kvhO7xkAV 0pbqRllJx8Wom1Nc3KBnPzU3oUZTGKOoOTuwbnSK3PgKAUlghqHr6RGLZFUjqnSGOZbSQB V7Ry5Tu69cTgGqlSR2hXTbz5ascQd+cYDsJOYF34n1v/j5jTJZQw+0GQAYFzsw== From: "yu kuai" In-Reply-To: <20260711100352.425177-4-chencheng@fnnas.com> Content-Transfer-Encoding: quoted-printable Subject: Re: [PATCH v7 3/3] md/raid10: free r10bio before ending master_bio in raid_end_bio_io() and raid_end_discard_bio() Message-Id: <2a399970-710a-49fb-ab72-e1076b05cfbc@fygo.io> Content-Type: text/plain; charset=UTF-8 User-Agent: Mozilla Thunderbird Reply-To: yukuai@fygo.io X-Lms-Return-Path: References: <20260711100352.425177-1-chencheng@fnnas.com> <20260711100352.425177-4-chencheng@fnnas.com> Received: from [192.168.1.104] ([39.182.0.144]) by smtp.larksuite.com with ESMTPS; Sat, 11 Jul 2026 17:43:54 +0000 To: "Chen Cheng" , Cc: Date: Sun, 12 Jul 2026 01:43:51 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Original-From: yu kuai Hi, =E5=9C=A8 2026/7/11 18:03, Chen Cheng =E5=86=99=E9=81=93: > From: Chen Cheng > > origin flow: > > bio_endio(master_bio); /* may drop active_io to zero */ > allow_barrier(conf); > free_r10bio(r10_bio); /* reads conf->geo, returns to pool */ > > one scenario is: > > CPU A (softirq, raid_end_bio_io) CPU B (action_store) --> resh= ape > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > bio_endio(master_bio) > md_end_clone_io > percpu_ref_put -> 0 > wait_event wakeup, and, > mddev_suspend return > raid10_start_reshape: > setup_geo(&conf->geo, new) > ... > mempool_destroy(old_pool) > conf->r10bio_pool =3D new_p= ool > allow_barrier(conf) > free_r10bio(r10_bio) > put_all_bios: > for (i=3D0; igeo.raid_disks; i++) > =3D=3D> old obj, new geo, OOB > mempool_free(r10_bio, conf->r10bio_pool) > =3D=3D> old-geometry obj freed into new pool > > so .. fix by reorder the flow: > > free_r10bio(r10_bio) > allow_barrier(conf) > bio_endio(master_bio) > > raid_end_discard_bio() is exactly the same. > > Signed-off-by: Chen Cheng > --- > drivers/md/raid10.c | 19 ++++++++++++------- > 1 file changed, 12 insertions(+), 7 deletions(-) > > diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c > index db68fcc9e9be..d77f60db7660 100644 > --- a/drivers/md/raid10.c > +++ b/drivers/md/raid10.c > @@ -329,24 +329,27 @@ static void reschedule_retry(struct r10bio *r10_bio= ) > */ > static void raid_end_bio_io(struct r10bio *r10_bio) > { > struct bio *bio =3D r10_bio->master_bio; > struct r10conf *conf =3D r10_bio->mddev->private; > + unsigned long state =3D r10_bio->state; > + bool returned; > =20 > - if (!test_and_set_bit(R10BIO_Returned, &r10_bio->state)) { > - if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) > - bio->bi_status =3D BLK_STS_IOERR; > + returned =3D test_and_set_bit(R10BIO_Returned, &state); > + if (!returned && !test_bit(R10BIO_Uptodate, &state)) > + bio->bi_status =3D BLK_STS_IOERR; > + > + free_r10bio(r10_bio); > + > + if (!returned) > bio_endio(bio); > - } Apparently this change is not enough, the R10BIO_Returned case still return the master_bio before freeing r10_bio. I think you should get an active_io reference while allocating r10_bio to guarantee that no r10_bio is active while array is suspended. > =20 > /* > * Wake up any possible resync thread that waits for the device > * to go idle. > */ > allow_barrier(conf); > - > - free_r10bio(r10_bio); > } > =20 > /* > * Update disk head position estimator based on IRQ completion info. > */ > @@ -1579,13 +1582,15 @@ static void raid_end_discard_bio(struct r10bio *r= 10bio) > if (!test_bit(R10BIO_Discard, &r10bio->state)) { > first_r10bio =3D (struct r10bio *)r10bio->master_bio; > free_r10bio(r10bio); > r10bio =3D first_r10bio; > } else { > + struct bio *master_bio =3D r10bio->master_bio; > + > md_write_end(r10bio->mddev); > - bio_endio(r10bio->master_bio); > free_r10bio(r10bio); > + bio_endio(master_bio); > break; > } > } > } > =20 --=20 Thanks, Kuai