Re: [PATCH 3/3] md/raid10: Don't free conf on raid10_run failure
From: sashiko-bot@kernel.org
Date: 2026-09-21 07:38:09
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] md/raid10: NULL ptr deref and I/O hang on raid10_run failure -- commit 1bebf502d0ba7be4661dc272d82091e48c0924ff Author: Zhihao Cheng [off-list ref] md/raid10: Don't free conf on raid10_run failure This patch prevents freeing the configuration on raid10_run() failure to avoid a null pointer dereference later during shutdown. It modifies the failure path to skip raid10_free_conf() and clearing mddev->private, leaving the conf structure allocated.
quoted hunk ↗ jump to hunk
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 1093c798d9dde..9e4d4202f35cf 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -4106,10 +4106,8 @@ static int raid10_run(struct mddev *mddev) return 0; -out_free_conf: +out_unregister_thread: md_unregister_thread(mddev, &mddev->thread); - raid10_free_conf(conf); - mddev->private = NULL;
[Severity: High]
Does leaving mddev->private allocated here expose the array to panics and
I/O hangs when raid10_run() fails?
Since the sysfs interface ignores personality run() failures:
drivers/md/md.c:level_store() {
...
pers->run(mddev);
...
}
The array remains pseudo-active. If subsequent I/O requests enter
raid10_make_request(), they can hang indefinitely because they attempt
to wake a NULL thread:
drivers/md/raid10.c:raid10_make_request() {
...
bio_list_add(&conf->pending_bio_list, mbio);
spin_unlock_irqrestore(&conf->device_lock, flags);
md_wakeup_thread(mddev->thread);
...
}
Furthermore, if a concurrent teardown or flush raises conf->barrier,
wait_barrier() will call stop_waiting_barrier(), which unconditionally
dereferences the NULL thread pointer, causing a panic:
drivers/md/raid10.c:stop_waiting_barrier() {
...
if (thread->tsk == current) {
...
}
out: return ret; }
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260921071537.2902362-1-chengzhihao1@huawei.com?part=3