[PATCH RFC v2] md: drop a never-started reshape request when stopping the array

["syzbot" <syzbot@kernel.org>]

Writing raid_disks, layout, or chunk_size on a running array records a
reshape request in struct mddev without starting the reshape until
sync_action is set to "reshape". Because super_90_sync() and super_1_sync()
only write reshape metadata to the superblock when reshape_position !=
MaxSector, a never-started reshape exists purely in memory. Dropping the
request when the array is stopped matches the state that would be loaded on
disk reassembly.

A minimal reproduction sequence is:

  echo 4 > /sys/block/md0/md/raid_disks
  echo inactive > /sys/block/md0/md/array_state
  echo active > /sys/block/md0/md/array_state

Modifying layout or chunk_size behaves similarly. When restarting the
array, raid5_run() previously assumed no reshape was taking place because
reshape_position was MaxSector and triggered a kernel BUG due to
delta_disks != 0:

kernel BUG at drivers/md/raid5.c:8117!
Oops: invalid opcode: 0000 [#1] SMP
RIP: 0010:raid5_run+0x2550/0x2560 drivers/md/raid5.c:8117
Call Trace:
 <TASK>
 md_run+0xc3d/0x1cd0 drivers/md/md.c:6779
 do_md_run+0x35/0x720 drivers/md/md.c:6880
 array_state_store+0x958/0xe90
 md_attr_store+0x3b7/0x640 drivers/md/md.c:6158
 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345
 vfs_write+0x612/0xba0 fs/read_write.c:687
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Commit 0669c7dbd1d3 replaced the BUG_ON in raid5_run() with an -EINVAL
check, but the underlying issue remained: raid5 fails to restart with
-EINVAL, and raid10 silently returns incorrect data due to unchecked
new_layout and new_chunk_sectors in setup_conf().

Drop the never-started reshape request in __md_stop() if no reshape is
currently running (mddev->reshape_position == MaxSector). Reset delta_disks
and reshape_backwards to 0, restore new_level, new_layout, and
new_chunk_sectors to level, layout, and chunk_sectors, and reset each
rdev's new_data_offset to data_offset. If a reshape is actively in progress
(mddev->reshape_position != MaxSector), the parameters are preserved so the
reshape can resume when the array is restarted.

Fixes: 9e653b6342c9 ("[PATCH] md: Set/get state of array via sysfs")
Assisted-by: Gemini:gemini-4-argon Gemini:gemini-3.8-flash syzbot
Reported-by: syzbot+1f5a7de91d547763f4c8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1f5a7de91d547763f4c8
Link: https://syzkaller.appspot.com/ai_job?id=aed1664c-30b2-4920-81b4-ed098ec14e92
To: <linux-raid@vger.kernel.org>
To: "Song Liu" <song@kernel.org>
To: "Yu Kuai" <yukuai@fygo.io>
To: "NeilBrown" <neilb@suse.de>
Cc: <linux-kernel@vger.kernel.org>
Cc: "Li Nan" <magiclinan@didiglobal.com>
Cc: "Xiao Ni" <xiao@kernel.org>

---
v2:
- Reset rdev->new_data_offset to rdev->data_offset for all member devices.
- Add an explanatory comment in __md_stop().
- Update commit subject and description per reviewer feedback.

v1:
https://lore.kernel.org/all/0bbc5530-3021-49ec-a8cd-a006c2639d53@mail.kernel.org/T/
---
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63..011a5ea54 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7084,6 +7084,7 @@ static void mddev_detach(struct mddev *mddev)
 static void __md_stop(struct mddev *mddev)
 {
 	struct md_personality *pers = mddev->pers;
+	struct md_rdev *rdev;
 
 	mddev_detach(mddev);
 	md_bitmap_destroy(mddev);
@@ -7095,6 +7096,21 @@ static void __md_stop(struct mddev *mddev)
 	mddev->private = NULL;
 	put_pers(pers);
 	clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+
+	/*
+	 * A reshape requested on a running array exists only in memory before
+	 * sync_action=reshape and should be dropped with the personality, while
+	 * a started reshape (reshape_position != MaxSector) is preserved.
+	 */
+	if (mddev->reshape_position == MaxSector) {
+		mddev->delta_disks = 0;
+		mddev->reshape_backwards = 0;
+		mddev->new_level = mddev->level;
+		mddev->new_layout = mddev->layout;
+		mddev->new_chunk_sectors = mddev->chunk_sectors;
+		rdev_for_each(rdev, mddev)
+			rdev->new_data_offset = rdev->data_offset;
+	}
 }
 
 void md_stop(struct mddev *mddev)


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.