From fe8d6b0187469c91d57dbc25ece5b503bfb3bc26 Mon Sep 17 00:00:00 2001 From: Chen Cheng Date: Sat, 11 Jul 2026 18:03:52 +0800 Subject: [PATCH] md/raid10: free r10bio before ending master_bio in raid_end_bio_io() and raid_end_discard_bio() origin flow: bio_endio(master_bio); /* may drop active_io to zero */ allow_barrier(conf); free_r10bio(r10_bio); /* reads conf->geo, returns to pool */ one scenario is: CPU A (softirq, raid_end_bio_io) CPU B (action_store) --> reshape ================================ =============================== bio_endio(master_bio) md_end_clone_io percpu_ref_put -> 0 wait_event wakeup, and, mddev_suspend return raid10_start_reshape: setup_geo(&conf->geo, new) ... mempool_destroy(old_pool) conf->r10bio_pool = new_pool allow_barrier(conf) free_r10bio(r10_bio) put_all_bios: for (i=0; igeo.raid_disks; i++) ==> old obj, new geo, OOB mempool_free(r10_bio, conf->r10bio_pool) ==> old-geometry obj freed into new pool so .. fix by reorder the flow: free_r10bio(r10_bio) bio_endio(master_bio) allow_barrier(conf) raid_end_discard_bio() is exactly the same. Signed-off-by: Chen Cheng Link: https://patch.msgid.link/20260711100352.425177-4-chencheng@fnnas.com Signed-off-by: Yu Kuai --- drivers/md/raid10.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 3f2da07676e7..ed3c6fbe65f7 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -331,20 +331,24 @@ static void raid_end_bio_io(struct r10bio *r10_bio) { struct bio *bio = r10_bio->master_bio; struct r10conf *conf = r10_bio->mddev->private; + bool returned = true; if (!test_and_set_bit(R10BIO_Returned, &r10_bio->state)) { if (!test_bit(R10BIO_Uptodate, &r10_bio->state)) bio->bi_status = BLK_STS_IOERR; - bio_endio(bio); + returned = false; } + free_r10bio(r10_bio); + + if (!returned) + bio_endio(bio); + /* * Wake up any possible resync thread that waits for the device * to go idle. */ allow_barrier(conf); - - free_r10bio(r10_bio); } /* @@ -1537,9 +1541,11 @@ static void raid_end_discard_bio(struct r10bio *r10bio) free_r10bio(r10bio); r10bio = first_r10bio; } else { + struct bio *master_bio = r10bio->master_bio; + md_write_end(r10bio->mddev); - bio_endio(r10bio->master_bio); free_r10bio(r10bio); + bio_endio(master_bio); break; } }