Re: [PATCH v7 0/3] md/raid10: fix r10bio width mismatches across reshape

[Mykola Marzhan]

Hi Cheng,

Independent confirmation of the bug this series fixes, in case more
evidence helps it land.

While running a KASAN campaign against the llbitmap reshape v2 series
(base 55b77337 — unrelated to your fix) every raid10 grow under IO hit
both faces of the width mismatch:

  BUG: KASAN: slab-out-of-bounds in free_r10bio+0x97/0x110
  Read of size 8 at addr ffff888149044ec8 by task ksoftirqd/2/28
   free_r10bio+0x97/0x110
   raid10_end_write_request+0x260/0x500
   blk_update_request+0x18b/0x6b0
  Allocated by task 232:
   mempool_alloc_noprof+0x108/0x1d0
   raid10_make_request+0x18b/0x1100

  BUG: KASAN: slab-out-of-bounds in raid10_make_request+0x214/0x1100
  Write of size 192 at addr ffff88814da7aa48 by task fio/460
   __asan_memset+0x23/0x50
   raid10_make_request+0x214/0x1100

(192 bytes = 6 x sizeof(struct r10dev) memset into a 4-disk
allocation.)

456 reports across 5 grow cycles (n2, 4->6 disks, four fio randwrite
jobs) on the plain base kernel. The mempool face matches your 2/3
exactly: the 256 preallocated r10bios keep the old width, so any
allocation that dips into the reserve after the grow is a guaranteed
OOB write, not just a read.

The storm is dense enough that raid10 grow under IO is not testable
under KASAN at all right now — which is how we ran into it, and why
we would like to see this land.

We plan to run v7 through the same rig and will follow up with the
result.

Thanks,
Mykola