Re: [PATCH v7 0/3] md/raid10: fix r10bio width mismatches across reshape
From: Mykola Marzhan
Date: Mon Jul 27 2026 - 06:55:11 EST
Hi Cheng,
Here are the test results I promised. v7 fixes it.
I used one kernel tree, rebuilt incrementally between the two builds,
so the only difference is your three patches. The array is raid10 n2
with 4 members. The load is four fio jobs: 4k randwrite, O_DIRECT,
iodepth 32. While the load runs, I --add two spares and then
--grow --raid-devices=6. The kernel is KASAN generic with
kasan_multi_shot. Each run is 5 cycles:
kernel runs cycles grows completed slab-out-of-bounds
base 1 5 5/5 128 (in 4 of 5 cycles)
base + v7 2 5 + 5 10/10 0
All 128 base reports are in free_r10bio(): 64 reads and 64 writes,
each of 8 bytes. There is also a second report site,
raid10_make_request(). A warm-up run on the same base hit it too,
with 2 slab-out-of-bounds there alongside 568 in free_r10bio(). So
both report sites are reachable with this workload.
Every cycle on both kernels logged "md: md0: reshape done." and the
same capacity change, so the grow really did run 10/10 on the patched
kernel, and fio was alive throughout each cycle.
The bug does not fire in every cycle: per-cycle counts on the base
were 0, 40, 8, 56, 24, so the base hit it in 4 of 5 cycles. That rate
is what gives the patched 10/10 zero its meaning.
Tested-by: Mykola Marzhan <mykola@xxxxxxxxxxx>
One practical note: v7 does not apply to mainline. Patch 2/3 carries
context
static void __make_request(struct mddev *mddev, struct bio *bio, int sectors)
but e045d6ed33f8 ("md/raid10: fix writes_pending leak on write request
failures") changed __make_request() to return bool. Applying
1/3..3/3 with --fuzz=0:
8e065a160251 (= e045d6ed33f8^) applies clean
e045d6ed33f8 fails
55b77337bdd0 fails
v7.2-rc4 fails
current mainline fails
So the numbers above are from 8e065a160251, which is the newest base v7
applies to. A rebase would probably help it get picked up — happy to
re-run the same rig on a v8 if you post one.
Thanks,
Mykola