* [syzbot] general protection fault in _wait_barrier
@ 2026-08-27 18:52 syzbot
2026-08-28 9:25 ` Edward Adam Davis
2026-08-28 10:39 ` [PATCH] md/raid1: prevent a race between write and stop request Edward Adam Davis
0 siblings, 2 replies; 6+ messages in thread
From: syzbot @ 2026-08-27 18:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 818bebeb63dd drm/xe: Don't hand out the flat CCS storage a..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1255d415580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13d96979580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
CPU: 1 UID: 0 PID: 6010 Comm: syz-executor394 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:_wait_barrier+0x8d/0x700 drivers/md/raid1.c:1066
Code: 08 00 00 00 f3 c7 40 0c f3 f3 f3 f3 65 48 8b 05 31 1e 0e 0c 48 89 84 24 d0 00 00 00 31 c0 e8 ea 3f 91 f9 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 11 06 00 00 4c 8b a3 20 01 00 00 4a 8d 04 ad
RSP: 0018:ffffc90003487290 EFLAGS: 00010206
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888031924b00 RSI: ffffffff8879c1e6 RDI: 0000000000000000
RBP: 0000000000000120 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff81d66229 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88802750c000 R15: ffffc900034879d0
FS: 00007fe51d1166c0(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599d4a2eb80 CR3: 0000000035c6b000 CR4: 0000000000352ef0
Call Trace:
<TASK>
wait_barrier drivers/md/raid1.c:1154 [inline]
raid1_write_request drivers/md/raid1.c:1506 [inline]
raid1_make_request+0x484/0x31a0 drivers/md/raid1.c:1696
md_handle_request+0x824/0x1230 drivers/md/md.c:417
md_submit_bio+0x1e9/0x350 drivers/md/md.c:458
__submit_bio block/blk-core.c:681 [inline]
__submit_bio+0x20e/0x3d0 block/blk-core.c:670
__submit_bio_noacct block/blk-core.c:724 [inline]
submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792
submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925
bio_await+0x1fa/0x240 block/bio.c:1580
submit_bio_wait+0x19/0x60 block/bio.c:1598
__blkdev_direct_IO_simple+0x4cb/0x8c0 block/fops.c:98
blkdev_direct_IO+0xbee/0x2030 block/fops.c:429
blkdev_direct_write block/fops.c:699 [inline]
blkdev_write_iter+0x703/0xd30 block/fops.c:767
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_pwrite64 fs/read_write.c:794 [inline]
__do_sys_pwrite64 fs/read_write.c:802 [inline]
__se_sys_pwrite64 fs/read_write.c:799 [inline]
__x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:799
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe51d1735de
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fe51d116128 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007fe51d1166c0 RCX: 00007fe51d1735de
RDX: 0000000000001000 RSI: 0000555588ed6000 RDI: 0000000000000005
RBP: 0000000000000021 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000002 R14: 00007ffdb60faaa0 R15: 00007ffdb60fab88
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:_wait_barrier+0x8d/0x700 drivers/md/raid1.c:1066
Code: 08 00 00 00 f3 c7 40 0c f3 f3 f3 f3 65 48 8b 05 31 1e 0e 0c 48 89 84 24 d0 00 00 00 31 c0 e8 ea 3f 91 f9 48 89 e8 48 c1 e8 03 <42> 80 3c 20 00 0f 85 11 06 00 00 4c 8b a3 20 01 00 00 4a 8d 04 ad
RSP: 0018:ffffc90003487290 EFLAGS: 00010206
RAX: 0000000000000024 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff888031924b00 RSI: ffffffff8879c1e6 RDI: 0000000000000000
RBP: 0000000000000120 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff81d66229 R12: dffffc0000000000
R13: 0000000000000000 R14: ffff88802750c000 R15: ffffc900034879d0
FS: 00007fe51d1166c0(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005599d4a2eb80 CR3: 0000000035c6b000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 08 00 or %al,(%rax)
2: 00 00 add %al,(%rax)
4: f3 c7 40 0c f3 f3 f3 xrelease movl $0xf3f3f3f3,0xc(%rax)
b: f3
c: 65 48 8b 05 31 1e 0e mov %gs:0xc0e1e31(%rip),%rax # 0xc0e1e45
13: 0c
14: 48 89 84 24 d0 00 00 mov %rax,0xd0(%rsp)
1b: 00
1c: 31 c0 xor %eax,%eax
1e: e8 ea 3f 91 f9 call 0xf991400d
23: 48 89 e8 mov %rbp,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 0f 85 11 06 00 00 jne 0x646
35: 4c 8b a3 20 01 00 00 mov 0x120(%rbx),%r12
3c: 4a rex.WX
3d: 8d .byte 0x8d
3e: 04 ad add $0xad,%al
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] general protection fault in _wait_barrier
2026-08-27 18:52 [syzbot] general protection fault in _wait_barrier syzbot
@ 2026-08-28 9:25 ` Edward Adam Davis
2026-08-28 10:13 ` syzbot
2026-08-28 10:39 ` [PATCH] md/raid1: prevent a race between write and stop request Edward Adam Davis
1 sibling, 1 reply; 6+ messages in thread
From: Edward Adam Davis @ 2026-08-28 9:25 UTC (permalink / raw)
To: syzbot+3fe892ea5fc292e1353f; +Cc: linux-kernel, syzkaller-bugs
From: Edward Aadm Davis <eadavis@sina.com>
#syz test: upstream 818bebeb63dd
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..8676b3bc463b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1692,11 +1692,34 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
if (bio_data_dir(bio) == READ)
raid1_read_request(mddev, bio, sectors, NULL);
else {
+ int err;
+
md_write_start(mddev, bio);
- if (!raid1_write_request(mddev, bio, sectors))
+ err = mddev_lock(mddev);
+
+ if (err < 0) {
+ md_write_end(mddev);
+ goto done;
+ }
+
+ if (!mddev->private) {
+ mddev_unlock(mddev);
+ md_write_end(mddev);
+ goto done;
+ }
+
+ err = raid1_write_request(mddev, bio, sectors);
+ mddev_unlock(mddev);
+
+ if (!err)
md_write_end(mddev);
}
+out:
return true;
+done:
+ bio->bi_status = BLK_STS_OFFLINE;
+ bio_endio(bio);
+ goto out;
}
static void raid1_status(struct seq_file *seq, struct mddev *mddev)
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] general protection fault in _wait_barrier
2026-08-28 9:25 ` Edward Adam Davis
@ 2026-08-28 10:13 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-08-28 10:13 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Tested-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Tested on:
commit: 818bebeb drm/xe: Don't hand out the flat CCS storage a..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=163b7625580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=10937625580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] md/raid1: prevent a race between write and stop request
2026-08-27 18:52 [syzbot] general protection fault in _wait_barrier syzbot
2026-08-28 9:25 ` Edward Adam Davis
@ 2026-08-28 10:39 ` Edward Adam Davis
2026-08-28 10:49 ` [PATCH v2] " Edward Adam Davis
2026-08-28 14:27 ` [PATCH] " Abd-Alrhman Masalkhi
1 sibling, 2 replies; 6+ messages in thread
From: Edward Adam Davis @ 2026-08-28 10:39 UTC (permalink / raw)
To: syzbot+3fe892ea5fc292e1353f
Cc: song, yukuai, magiclinan, xiao, linux-raid, linux-kernel, syzkaller-bugs
A race condition exists between write and stop requests, leading to a
null-ptr-deref in [1].
CPU0 CPU1
==== ====
md_submit_bio()
md_handle_request() do_md_stop()__md_stop()
raid1_make_request() __md_stop()
raid1_write_request() mddev->private = NULL
wait_barrier()
conf->nr_pending //trigger [1]
The intervention of a stop request causes inconsistencies in the state
of mddev members (such as private and pers) while a write request is
executing; the mddev lock is used to synchronize write and stop requests,
thereby ensuring consistent mddev state throughout the execution of the
write request.
Additionally, when a write operation reaches the RAID1 layer, if a stop
request acquires the mddev lock first and releases mddev->private, the
bio is terminated and the write request exits.
[1]
KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
RIP: 0010:_wait_barrier+0x8d/0x700 drivers/md/raid1.c:1066
Call Trace:
wait_barrier drivers/md/raid1.c:1154 [inline]
raid1_write_request drivers/md/raid1.c:1506 [inline]
raid1_make_request+0x484/0x31a0 drivers/md/raid1.c:1696
md_handle_request+0x824/0x1230 drivers/md/md.c:417
md_submit_bio+0x1e9/0x350 drivers/md/md.c:458
__submit_bio block/blk-core.c:681 [inline]
__submit_bio+0x20e/0x3d0 block/blk-core.c:670
__submit_bio_noacct block/blk-core.c:724 [inline]
submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792
submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925
bio_await+0x1fa/0x240 block/bio.c:1580
submit_bio_wait+0x19/0x60 block/bio.c:1598
__blkdev_direct_IO_simple+0x4cb/0x8c0 block/fops.c:98
blkdev_direct_IO+0xbee/0x2030 block/fops.c:429
blkdev_direct_write block/fops.c:699 [inline]
blkdev_write_iter+0x703/0xd30 block/fops.c:767
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f
Tested-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
drivers/md/raid1.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..3b9f1fa65e65 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1674,6 +1674,7 @@ static bool raid1_write_request(struct mddev *mddev, struct bio *bio,
static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
{
sector_t sectors;
+ blk_status_t status;
if (unlikely(bio->bi_opf & REQ_PREFLUSH)
&& md_flush_request(mddev, bio))
@@ -1692,11 +1693,36 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
if (bio_data_dir(bio) == READ)
raid1_read_request(mddev, bio, sectors, NULL);
else {
+ int err;
+
md_write_start(mddev, bio);
- if (!raid1_write_request(mddev, bio, sectors))
+ err = mddev_lock(mddev);
+
+ if (err < 0) {
+ md_write_end(mddev);
+ status = BLK_STS_IOERR;
+ goto done;
+ }
+
+ if (!mddev->private) {
+ mddev_unlock(mddev);
+ md_write_end(mddev);
+ status = BLK_STS_OFFLINE;
+ goto done;
+ }
+
+ err = raid1_write_request(mddev, bio, sectors);
+ mddev_unlock(mddev);
+
+ if (!err)
md_write_end(mddev);
}
+out:
return true;
+done:
+ bio->bi_status = status;
+ bio_endio(bio);
+ goto out;
}
static void raid1_status(struct seq_file *seq, struct mddev *mddev)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] md/raid1: prevent a race between write and stop request
2026-08-28 10:39 ` [PATCH] md/raid1: prevent a race between write and stop request Edward Adam Davis
@ 2026-08-28 10:49 ` Edward Adam Davis
2026-08-28 14:27 ` [PATCH] " Abd-Alrhman Masalkhi
1 sibling, 0 replies; 6+ messages in thread
From: Edward Adam Davis @ 2026-08-28 10:49 UTC (permalink / raw)
To: eadavis
Cc: linux-kernel, linux-raid, magiclinan, song,
syzbot+3fe892ea5fc292e1353f, syzkaller-bugs, xiao, yukuai
A race condition exists between write and stop requests, leading to a
null-ptr-deref in [1].
CPU0 CPU1
==== ====
md_submit_bio()
md_handle_request() do_md_stop()
raid1_make_request() __md_stop()
raid1_write_request() mddev->private = NULL
wait_barrier()
conf->nr_pending //trigger [1]
The intervention of a stop request causes inconsistencies in the state
of mddev members (such as private and pers) while a write request is
executing; the mddev lock is used to synchronize write and stop requests,
thereby ensuring consistent mddev state throughout the execution of the
write request.
Additionally, when a write operation reaches the RAID1 layer, if a stop
request acquires the mddev lock first and releases mddev->private, the
bio is terminated and the write request exits.
[1]
KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
RIP: 0010:_wait_barrier+0x8d/0x700 drivers/md/raid1.c:1066
Call Trace:
wait_barrier drivers/md/raid1.c:1154 [inline]
raid1_write_request drivers/md/raid1.c:1506 [inline]
raid1_make_request+0x484/0x31a0 drivers/md/raid1.c:1696
md_handle_request+0x824/0x1230 drivers/md/md.c:417
md_submit_bio+0x1e9/0x350 drivers/md/md.c:458
__submit_bio block/blk-core.c:681 [inline]
__submit_bio+0x20e/0x3d0 block/blk-core.c:670
__submit_bio_noacct block/blk-core.c:724 [inline]
submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792
submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925
bio_await+0x1fa/0x240 block/bio.c:1580
submit_bio_wait+0x19/0x60 block/bio.c:1598
__blkdev_direct_IO_simple+0x4cb/0x8c0 block/fops.c:98
blkdev_direct_IO+0xbee/0x2030 block/fops.c:429
blkdev_direct_write block/fops.c:699 [inline]
blkdev_write_iter+0x703/0xd30 block/fops.c:767
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f
Tested-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@sina.com>
---
v1 -> v2: typo in comments
drivers/md/raid1.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371..3b9f1fa65e65 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1674,6 +1674,7 @@ static bool raid1_write_request(struct mddev *mddev, struct bio *bio,
static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
{
sector_t sectors;
+ blk_status_t status;
if (unlikely(bio->bi_opf & REQ_PREFLUSH)
&& md_flush_request(mddev, bio))
@@ -1692,11 +1693,36 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
if (bio_data_dir(bio) == READ)
raid1_read_request(mddev, bio, sectors, NULL);
else {
+ int err;
+
md_write_start(mddev, bio);
- if (!raid1_write_request(mddev, bio, sectors))
+ err = mddev_lock(mddev);
+
+ if (err < 0) {
+ md_write_end(mddev);
+ status = BLK_STS_IOERR;
+ goto done;
+ }
+
+ if (!mddev->private) {
+ mddev_unlock(mddev);
+ md_write_end(mddev);
+ status = BLK_STS_OFFLINE;
+ goto done;
+ }
+
+ err = raid1_write_request(mddev, bio, sectors);
+ mddev_unlock(mddev);
+
+ if (!err)
md_write_end(mddev);
}
+out:
return true;
+done:
+ bio->bi_status = status;
+ bio_endio(bio);
+ goto out;
}
static void raid1_status(struct seq_file *seq, struct mddev *mddev)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] md/raid1: prevent a race between write and stop request
2026-08-28 10:39 ` [PATCH] md/raid1: prevent a race between write and stop request Edward Adam Davis
2026-08-28 10:49 ` [PATCH v2] " Edward Adam Davis
@ 2026-08-28 14:27 ` Abd-Alrhman Masalkhi
1 sibling, 0 replies; 6+ messages in thread
From: Abd-Alrhman Masalkhi @ 2026-08-28 14:27 UTC (permalink / raw)
To: Edward Adam Davis, syzbot+3fe892ea5fc292e1353f
Cc: song, yukuai, magiclinan, xiao, linux-raid, linux-kernel, syzkaller-bugs
Hi Edward,
On Fri, Aug 28, 2026 at 18:39 +0800, Edward Adam Davis wrote:
> A race condition exists between write and stop requests, leading to a
> null-ptr-deref in [1].
>
> CPU0 CPU1
> ==== ====
> md_submit_bio()
> md_handle_request() do_md_stop()__md_stop()
do_md_stop() must never execute while the array device file is open.
take a look if this rule is not meet.
> raid1_make_request() __md_stop()
> raid1_write_request() mddev->private = NULL
> wait_barrier()
> conf->nr_pending //trigger [1]
>
> The intervention of a stop request causes inconsistencies in the state
> of mddev members (such as private and pers) while a write request is
> executing; the mddev lock is used to synchronize write and stop requests,
> thereby ensuring consistent mddev state throughout the execution of the
> write request.
>
> Additionally, when a write operation reaches the RAID1 layer, if a stop
> request acquires the mddev lock first and releases mddev->private, the
> bio is terminated and the write request exits.
>
> [1]
> KASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]
> RIP: 0010:_wait_barrier+0x8d/0x700 drivers/md/raid1.c:1066
> Call Trace:
> wait_barrier drivers/md/raid1.c:1154 [inline]
> raid1_write_request drivers/md/raid1.c:1506 [inline]
> raid1_make_request+0x484/0x31a0 drivers/md/raid1.c:1696
> md_handle_request+0x824/0x1230 drivers/md/md.c:417
> md_submit_bio+0x1e9/0x350 drivers/md/md.c:458
> __submit_bio block/blk-core.c:681 [inline]
> __submit_bio+0x20e/0x3d0 block/blk-core.c:670
> __submit_bio_noacct block/blk-core.c:724 [inline]
> submit_bio_noacct_nocheck+0x736/0xc00 block/blk-core.c:792
> submit_bio_noacct+0xc93/0x2130 block/blk-core.c:925
> bio_await+0x1fa/0x240 block/bio.c:1580
> submit_bio_wait+0x19/0x60 block/bio.c:1598
> __blkdev_direct_IO_simple+0x4cb/0x8c0 block/fops.c:98
> blkdev_direct_IO+0xbee/0x2030 block/fops.c:429
> blkdev_direct_write block/fops.c:699 [inline]
> blkdev_write_iter+0x703/0xd30 block/fops.c:767
> new_sync_write fs/read_write.c:595 [inline]
> vfs_write+0x6af/0x1050 fs/read_write.c:687
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f
> Tested-by: syzbot+3fe892ea5fc292e1353f@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@sina.com>
> ---
> drivers/md/raid1.c | 28 +++++++++++++++++++++++++++-
> 1 file changed, 27 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
> index f0646fb24371..3b9f1fa65e65 100644
> --- a/drivers/md/raid1.c
> +++ b/drivers/md/raid1.c
> @@ -1674,6 +1674,7 @@ static bool raid1_write_request(struct mddev *mddev, struct bio *bio,
> static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
> {
> sector_t sectors;
> + blk_status_t status;
>
> if (unlikely(bio->bi_opf & REQ_PREFLUSH)
> && md_flush_request(mddev, bio))
> @@ -1692,11 +1693,36 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
> if (bio_data_dir(bio) == READ)
> raid1_read_request(mddev, bio, sectors, NULL);
> else {
> + int err;
> +
> md_write_start(mddev, bio);
> - if (!raid1_write_request(mddev, bio, sectors))
> + err = mddev_lock(mddev);
> +
> + if (err < 0) {
> + md_write_end(mddev);
> + status = BLK_STS_IOERR;
> + goto done;
> + }
> +
> + if (!mddev->private) {
> + mddev_unlock(mddev);
> + md_write_end(mddev);
> + status = BLK_STS_OFFLINE;
> + goto done;
> + }
> +
> + err = raid1_write_request(mddev, bio, sectors);
> + mddev_unlock(mddev);
> +
> + if (!err)
> md_write_end(mddev);
> }
> +out:
> return true;
> +done:
> + bio->bi_status = status;
> + bio_endio(bio);
> + goto out;
> }
>
> static void raid1_status(struct seq_file *seq, struct mddev *mddev)
> --
> 2.43.0
>
>
--
Best Regards,
Abd-Alrhman
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-28 14:27 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-27 18:52 [syzbot] general protection fault in _wait_barrier syzbot
2026-08-28 9:25 ` Edward Adam Davis
2026-08-28 10:13 ` syzbot
2026-08-28 10:39 ` [PATCH] md/raid1: prevent a race between write and stop request Edward Adam Davis
2026-08-28 10:49 ` [PATCH v2] " Edward Adam Davis
2026-08-28 14:27 ` [PATCH] " Abd-Alrhman Masalkhi
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®