From nobody Mon Jun 8 09:48:38 2026 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 08F612E7F3E for ; Sat, 30 May 2026 15:14:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780154059; cv=none; b=djinlIfSYDP21VwoJ0tJU+a9b1WjAn1twEI3/RfgVGQPw9JzNY5r+OYk0h7T+9xEExrzLHIArUgTDXlY/oV/IdGQrHTyT5sxUY8d7XcKmR/hbshqkxJ3lQSB9wg+FZxXX7p63FFa01N8H/hCPKphPlExE1RlVIiksw2kGFoZoi4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780154059; c=relaxed/simple; bh=DXWVCZysxKD9gfXEdslRTOa4j3AnF6pQmITytnjmAb4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=WwbEVrvWyIt3pgB3XOvGnySjBZRqaRER8/8HP6K7kb72MHkVIzisNpSl29a6dWGZVhCFdWVyz+55ZECZ4BStQfF+ldVZPff8gPjvGZbMToxo7nD364Z1+qAboMOqMwaITEyCcPncRymjFgRIbHASYC1lZaLy0qX9HlNUJ5BEnCA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=rLw40wt0; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="rLw40wt0" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-45ef189aa1cso1405906f8f.0 for ; Sat, 30 May 2026 08:14:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780154055; x=1780758855; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+5ipmyFXNMCUBMZJUA0wkXx6dJbNhAJkRdCthVvgCPQ=; b=rLw40wt0syxzHw7Es+3eBz1HvoHdAkE5xgH89nZSMNRjGQlm0vKT+lkxeuR8N8p7Hy 8WQjEq9WbAso2xdQB6m7z5ig/yg+bWbiwynyy8EvYFM/fMFGl9BRo4BehG+vUd85zeJH E4zrfV7MlyEMMm1ow2cQj4mC9PyNbnLse9XCDwqvt8glD+qSV5mMsNwyLuUj6ytYypDl pjLAs4LtLuul2cfIqJpjB+XQKUOB3B6LG0/JBtp1HLEbiN6dchWc1Q3/LATr4NwZuc1g tEnA3C5/Es+K8zqKlPlvKfy48+8XaWmCR0HuqCWvxUjtndVq8bRn3LOCRC6ZQNsgWQxS CweQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780154055; x=1780758855; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+5ipmyFXNMCUBMZJUA0wkXx6dJbNhAJkRdCthVvgCPQ=; b=P3dI8taAZFtjeuCfy+hDdrlxmObqjhbWhPg/Pi6/jE0hiGWwzWXBe3kSj+wcpSgOV/ 1CTyY7UGIUH+H4hr91XYAgXO9b4xAF7YqEkmBAVj3ljGcKugTH+rgywPME1gVa0uJhbI bwgHCojz1bnxq1qZyjTGrGqOU0ClYUsSw4EYvIkZz1S1ow2PcnyBDxl3xdcsNbBVSOje bYhgW3C3F6o+mPgps8+bAj9wkOzdvA8SexYiUZyR+SEIIvHX5mlvRbmhxZLsLQUYSl1O obqV+grbmNUnyZhHkPmHWg8Leq7M16FMuPNtziXhnJBfjDD8KDKAB9DUGF+H4my6LVlV Xtyg== X-Forwarded-Encrypted: i=1; AFNElJ9lgzujCKOMKbiXf5XOMvbyom3WRgaPnzU47hOaYoYGIed+95tP0AiA9YGCvqkapcyiEjm6yqGHi3G4Mr0=@vger.kernel.org X-Gm-Message-State: AOJu0Yztj9w7fCXIbquSEBPg25LlYBLnyx6C+Xc7tzuEhaDCbA4vkEGb u0xGqVZDGNv3dULkprRKGnZvG5AKuc7vLUk346mKsCJWRflZeqskTGwi X-Gm-Gg: Acq92OFum/Lo37FgbnpladOlsiojt12X+Bei3OQkj1i8CTTbFU8jn9Boc9E/dSRFC6b i+5x7HScKQgl1sSbpeBBiW52rIY2X6z4nQJY49f3chOD99xtb7PmS8UGVQphLha/1E9PGVY/BTg rwK5g4myfV4KnbS4GSAWz589epgmGxxAN5Yg4EJ6dDu62u8xQiUcjADAnjsBeY8TYGIiUMyz7e6 zhrG4jVBW+lcCwm66NrgXGZWWEC/4NlmX8r6i/yPCoqoR0sNcWzqUx0EOIQliyud2CI8V6NwJE0 +0cE8uP4JpBg6rjMFSPX5cMs9nnKLcNlA4UQ4bGQ8uD+GPdIyzOXBZpYa8Fe0SjTXJnRUp/ZQk/ cUD8XN4ImqmmMphy/IDXb2f10yadvPyUWvBRQHQYsiPoXd4OCM94PjjKCo8pNxZXw2Y7M9JFUtk 0wCkNgyaxzy4oac3qlqxZgOyvAKy4RZZo5x0N4JVWRxdPBk9AO3pczBrGkVURgq/VYJwUgw5uG0 /5J2nkLAWk= X-Received: by 2002:adf:e84c:0:b0:45e:ec17:430a with SMTP id ffacd0b85a97d-45ef6afbf37mr6298090f8f.11.1780154055307; Sat, 30 May 2026 08:14:15 -0700 (PDT) Received: from yocto.. (dynamic-176-007-201-005.176.7.pool.telefonica.de. [176.7.201.5]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45ef35874b7sm11878817f8f.35.2026.05.30.08.14.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 08:14:14 -0700 (PDT) From: Abd-Alrhman Masalkhi To: song@kernel.org, yukuai@fnnas.com, linan122@huawei.com, john.g.garry@oracle.com, martin.petersen@oracle.com, axboe@kernel.dk Cc: linux-raid@vger.kernel.org, linux-kernel@vger.kernel.org, Abd-Alrhman Masalkhi Subject: [PATCH] raid1: fix nr_pending leak in REQ_ATOMIC bad-block error path Date: Sat, 30 May 2026 15:14:11 +0000 Message-ID: <20260530151411.4119-1-abd.masalkhi@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In raid1_write_request(), each per-mirror loop iteration begins by incrementing rdev->nr_pending. If a REQ_ATOMIC write encounters a badblock within the requested range, the code jumps to err_handle without dropping the reference taken for the current mirror. err_handle's cleanup loop will only decrements for k < i and r1_bio->bios[k] is non-NULL. The current slot is therefore skipped, leaving its nr_pending reference leaked permanently. The reference prevents the rdev from ever being removed, since raid1_remove_conf() refuses to remove an rdev with nr_pending > 0. Fix this by calling rdev_dec_pending() before jumping to err_handle. Fixes: f2a38abf5f1c ("md/raid1: Atomic write support") Signed-off-by: Abd-Alrhman Masalkhi Reviewed-by: John Garry --- drivers/md/raid1.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 181400e147c0..0084bbc24076 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1580,8 +1580,10 @@ static void raid1_write_request(struct mddev *mddev,= struct bio *bio, * complexity of supporting that is not worth * the benefit. */ - if (bio->bi_opf & REQ_ATOMIC) + if (bio->bi_opf & REQ_ATOMIC) { + rdev_dec_pending(rdev, mddev); goto err_handle; + } =20 good_sectors =3D first_bad - r1_bio->sector; if (good_sectors < max_sectors) --=20 2.43.0