• Yu Kuai's avatar
    md: remove flag RemoveSynchronized · c891f1fd
    Yu Kuai authored
    rcu is not used correctly here, because synchronize_rcu() is called
    before replacing old value, for example:
    
    remove_and_add_spares   // other path
     synchronize_rcu
     // called before replacing old value
     set_bit(RemoveSynchronized)
                            rcu_read_lock()
                            rdev = conf->mirros[].rdev
     pers->hot_remove_disk
      conf->mirros[].rdev = NULL;
      if (!test_bit(RemoveSynchronized))
       synchronize_rcu
       /*
        * won't be called, and won't wait
        * for concurrent readers to be done.
        */
                            // access rdev after remove_and_add_spares()
                            rcu_read_unlock()
    
    Fortunately, there is a separate rcu protection to prevent such rdev
    to be freed:
    
    md_kick_rdev_from_array		//other path
    				rcu_read_lock()
    				rdev = conf->mirros[].rdev
    list_del_rcu(&rdev->same_set)
    
    				rcu_read_unlock()
    				/*
    				 * rdev can be removed from conf, but
    				 * rdev won't be freed.
    				 */
    synchronize_rcu()
    free rdev
    
    Hence remove this useless flag and prepare to remove rcu protection to
    access rdev from 'conf'.
    Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
    Signed-off-by: default avatarSong Liu <song@kernel.org>
    Link: https://lore.kernel.org/r/20231125081604.3939938-2-yukuai1@huaweicloud.com
    c891f1fd
md.c 263 KB