Re: [PATCH] md/raid5: protect lockless recovery_offset accesses during reshape

[yu kuai]

在 2026/6/27 18:25, Chen Cheng 写道:

> From: Chen Cheng<chencheng@xxxxxxxxx>
>
> During reshape:
> - reshape_request() advances rdev->recovery_offset for non-In_sync
>    devices locklessly.
> - analyse_stripe() reads rdev->recovery_offset locklessly to decide:
>      a. use a replacement device to read ?
>      b. a device can already be treated as in-sync for the current
>         stripe ?
>
> one possible scenario is:
>
> CPU1                            CPU2
> reshape_request()
> -> mddev->curr_resync_completed = sector_nr
> -> if (!mddev->reshape_backwards)
> -> rdev->recovery_offset = sector_nr
>                                  analyse_stripe(sh)
>                                  -> rdev = conf->disks[i].replacement
>                                  -> if (rdev->recovery_offset >=
>                                        sh->sector + stripe_sectors)
>                                     set_bit(R5_ReadRepl)
>                                  -> or
>                                  -> if (sh->sector + stripe_sectors <=
>                                        rdev->recovery_offset)
>                                     set_bit(R5_Insync)
>
> And it could be:
>
> - reading from a replacement before it is recovered far enough; or
> - treating a not-yet-recovered device as in-sync for the current stripe.
>
> Fixes: db0505d32066 ("md: be cautious about using ->curr_resync_completed for ->recovery_offset")
>
> The race report:
> ==================================================================
> BUG: KCSAN: data-race in ops_run_io / reshape_request
>
> write to 0xffff8bdee168b270 of 8 bytes by task 1704 on cpu 10:
>   reshape_request+0x1292/0x17b0
>   raid5_sync_request+0x815/0xa00
>   md_do_sync.cold+0xf8d/0x1516
>   [......]
>
> read to 0xffff8bdee168b270 of 8 bytes by task 1696 on cpu 9:
>   ops_run_io+0xc25/0x1960
>   handle_stripe+0x2273/0x4570
>   handle_active_stripes.isra.0+0x6e0/0xa50
>   raid5d+0x7d5/0xb90
>   [......]
>
> value changed: 0x0000000000091a00 -> 0x0000000000091b00
> ==================================================================
>
> Signed-off-by: Chen Cheng<chencheng@xxxxxxxxx>
> ---
>   drivers/md/raid5.c | 34 +++++++++++++++++-----------------
>   1 file changed, 17 insertions(+), 17 deletions(-)
Reviewed-by: Yu Kuai <yukuai@xxxxxxx>

-- 
Thanks,
Kuai