linux-kernel - [PATCH] md raid: fix hang when stopping arrays with metadata through dm-raid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b58dddf537d5aa7519670a4df5838e7056a37c2a.1758201368.git.heinzm@redhat.com>
Date: Thu, 18 Sep 2025 15:42:42 +0200
From: Heinz Mauelshagen <heinzm@...hat.com>
To: song@...nel.org
Cc: linux-raid@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Heinz Mauelshagen <heinzm@...hat.com>
Subject: [PATCH] md raid: fix hang when stopping arrays with metadata through dm-raid

When using device-mapper's dm-raid target, stopping a RAID array can cause the
system to hang under specific conditions.

This occurs when:

-  A dm-raid managed device tree is suspended from top to bottom
   (the top-level RAID device is suspended first, followed by its
    underlying metadata and data devices)

-  The top-level RAID device is then removed

The hang happens because removing the top-level device triggers md_stop() from the
dm-raid destructor.  This function attempts to flush the write-intent bitmap, which
requires writing bitmap superblocks to the metadata sub-devices.  However, since
these metadata devices are already suspended, the write operations cannot complete,
causing the system to hang.

Fix:

-  Prevent bitmap flushing when md_stop() is called from dm-raid contexts
   and avoid a quiescing/unquescing cycle which could also cause I/O

-  Avoid any I/O operations that might occur during the quiesce/unquiesce process in md_stop()

This ensures that RAID array teardown can complete successfully even when the
underlying devices are in a suspended state.

Signed-off-by: Heinz Mauelshagen <heinzm@...hat.com>
---
 drivers/md/md.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4e033c26fdd4..53e15bdd9ab2 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6541,12 +6541,14 @@ static void __md_stop_writes(struct mddev *mddev)
 {
 	timer_delete_sync(&mddev->safemode_timer);
 
-	if (mddev->pers && mddev->pers->quiesce) {
-		mddev->pers->quiesce(mddev, 1);
-		mddev->pers->quiesce(mddev, 0);
-	}
+	if (!mddev_is_dm(mddev)) {
+		if (mddev->pers && mddev->pers->quiesce) {
+			mddev->pers->quiesce(mddev, 1);
+			mddev->pers->quiesce(mddev, 0);
+		}
 
-	mddev->bitmap_ops->flush(mddev);
+		mddev->bitmap_ops->flush(mddev);
+	}
 
 	if (md_is_rdwr(mddev) &&
 	    ((!mddev->in_sync && !mddev_is_clustered(mddev)) ||
-- 
2.51.0