On 10/09/2017 12:10 AM, NeilBrown wrote:

If there is some action that mdadm can currently be told to perform, and
when it tries to perform that action it corrupts the array, then
it is certainly appropriate to teach mdadm not to perform that action.
It shouldn't even perform that action with --force.   I agree that
changing mdadm like this is complementary to changing the kernel.  Both
are useful.

A certain amount of the trouble with all of this is the english meaning
of "grow" doesn't really match what mdadm allows.

Might it be reasonable to reject "--grow" operations that reduce the
final array size, and introduce the complementary "--reduce" operation
that rejects array size increases?

Both operations would share the current code, just apply a different
sanity check before proceeding.

mdadm would then at least not violate the rule of least surprise.

Phil