[PATCH 0/2] md/md-llbimtap: fix two corner case problems

[PATCH 0/2] md/md-llbimtap: fix two corner case problems

[Yu Kuai]

Yu Kuai (2):
  md/raid5: fix IO hang with degraded array with llbitmap
  md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

 drivers/md/md-llbitmap.c | 4 +++-
 drivers/md/raid5.c       | 7 ++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

-- 
2.51.0

[PATCH 1/2] md/raid5: fix IO hang with degraded array with llbitmap

[Yu Kuai]

When llbitmap bit state is still unwritten, any new write should force
rcw, as bitmap_ops->blocks_synced() is checked in handle_stripe_dirting().
However, later the same check is missing in need_this_block(), causing
stripe to deadloop during handling because handle_stripe() will decide
to go to handle_stripe_fill(), meanwhile need_this_block() always return
0 and nothing is handled.

Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
---
 drivers/md/raid5.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 8dc98f545969..93e672b3432b 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3751,9 +3751,14 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
 	struct r5dev *dev = &sh->dev[disk_idx];
 	struct r5dev *fdev[2] = { &sh->dev[s->failed_num[0]],
 				  &sh->dev[s->failed_num[1]] };
+	struct mddev *mddev = sh->raid_conf->mddev;
+	bool force_rcw = false;
 	int i;
-	bool force_rcw = (sh->raid_conf->rmw_level == PARITY_DISABLE_RMW);
 
+	if (sh->raid_conf->rmw_level == PARITY_DISABLE_RMW ||
+	    (mddev->bitmap_ops && mddev->bitmap_ops->blocks_synced &&
+	     !mddev->bitmap_ops->blocks_synced(mddev, sh->sector)))
+		force_rcw = true;
 
 	if (test_bit(R5_LOCKED, &dev->flags) ||
 	    test_bit(R5_UPTODATE, &dev->flags))
-- 
2.51.0

[PATCH 2/2] md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

[Yu Kuai]

When llbitmap_suspend_timeout() times out waiting for percpu_ref to
become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref.
The caller (md_llbitmap_daemon_fn) then continues to the next page
without calling llbitmap_resume(), leaving the percpu_ref in a killed
state permanently.

Fix this by resurrecting the percpu_ref before returning the error,
ensuring the page control structure remains usable for subsequent
operations.

Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap")
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
---
 drivers/md/md-llbitmap.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/md-llbitmap.c b/drivers/md/md-llbitmap.c
index b482a1db0861..7df15756142d 100644
--- a/drivers/md/md-llbitmap.c
+++ b/drivers/md/md-llbitmap.c
@@ -779,8 +779,10 @@ static int llbitmap_suspend_timeout(struct llbitmap *llbitmap, int page_idx)
 	percpu_ref_kill(&pctl->active);
 
 	if (!wait_event_timeout(pctl->wait, percpu_ref_is_zero(&pctl->active),
-			llbitmap->mddev->bitmap_info.daemon_sleep * HZ))
+			llbitmap->mddev->bitmap_info.daemon_sleep * HZ)) {
+		percpu_ref_resurrect(&pctl->active);
 		return -ETIMEDOUT;
+	}
 
 	return 0;
 }
-- 
2.51.0

Re: [PATCH 2/2] md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

[Li Nan]

在 2026/1/24 2:26, Yu Kuai 写道:
> When llbitmap_suspend_timeout() times out waiting for percpu_ref to
> become zero, it returns -ETIMEDOUT without resurrecting the percpu_ref.
> The caller (md_llbitmap_daemon_fn) then continues to the next page
> without calling llbitmap_resume(), leaving the percpu_ref in a killed
> state permanently.
> 
> Fix this by resurrecting the percpu_ref before returning the error,
> ensuring the page control structure remains usable for subsequent
> operations.
> 
> Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap")
> Signed-off-by: Yu Kuai <yukuai@fnnas.com>
> ---
>   drivers/md/md-llbitmap.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/md-llbitmap.c b/drivers/md/md-llbitmap.c
> index b482a1db0861..7df15756142d 100644
> --- a/drivers/md/md-llbitmap.c
> +++ b/drivers/md/md-llbitmap.c
> @@ -779,8 +779,10 @@ static int llbitmap_suspend_timeout(struct llbitmap *llbitmap, int page_idx)
>   	percpu_ref_kill(&pctl->active);
>   
>   	if (!wait_event_timeout(pctl->wait, percpu_ref_is_zero(&pctl->active),
> -			llbitmap->mddev->bitmap_info.daemon_sleep * HZ))
> +			llbitmap->mddev->bitmap_info.daemon_sleep * HZ)) {
> +		percpu_ref_resurrect(&pctl->active);
>   		return -ETIMEDOUT;
> +	}
>   
>   	return 0;
>   }

LGTM

Reviewed-by: Li Nan <linan122@huawei.com>

-- 
Thanks,
Nan

Re: [PATCH 0/2] md/md-llbimtap: fix two corner case problems

[Jens Axboe]

On 1/23/26 11:26 AM, Yu Kuai wrote:
> Yu Kuai (2):
>   md/raid5: fix IO hang with degraded array with llbitmap
>   md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout
> 
>  drivers/md/md-llbitmap.c | 4 +++-
>  drivers/md/raid5.c       | 7 ++++++-
>  2 files changed, 9 insertions(+), 2 deletions(-)

Is this just for review, or do you want them picked up off the list
too?

Both look fine to me, fwiw.

-- 
Jens Axboe

Re: [PATCH 1/2] md/raid5: fix IO hang with degraded array with llbitmap

[Li Nan]

在 2026/1/24 2:26, Yu Kuai 写道:
> When llbitmap bit state is still unwritten, any new write should force
> rcw, as bitmap_ops->blocks_synced() is checked in handle_stripe_dirting().

s/handle_stripe_dirting/handle_stripe_dirtying/

Besides this, LGTM

Reviewed-by: Li Nan <linan122@huawei.com>

> However, later the same check is missing in need_this_block(), causing
> stripe to deadloop during handling because handle_stripe() will decide
> to go to handle_stripe_fill(), meanwhile need_this_block() always return
> 0 and nothing is handled.
> 
> Fixes: 5ab829f1971d ("md/md-llbitmap: introduce new lockless bitmap")
> Signed-off-by: Yu Kuai <yukuai@fnnas.com>
> ---
>   drivers/md/raid5.c | 7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
> index 8dc98f545969..93e672b3432b 100644
> --- a/drivers/md/raid5.c
> +++ b/drivers/md/raid5.c
> @@ -3751,9 +3751,14 @@ static int need_this_block(struct stripe_head *sh, struct stripe_head_state *s,
>   	struct r5dev *dev = &sh->dev[disk_idx];
>   	struct r5dev *fdev[2] = { &sh->dev[s->failed_num[0]],
>   				  &sh->dev[s->failed_num[1]] };
> +	struct mddev *mddev = sh->raid_conf->mddev;
> +	bool force_rcw = false;
>   	int i;
> -	bool force_rcw = (sh->raid_conf->rmw_level == PARITY_DISABLE_RMW);
>   
> +	if (sh->raid_conf->rmw_level == PARITY_DISABLE_RMW ||
> +	    (mddev->bitmap_ops && mddev->bitmap_ops->blocks_synced &&
> +	     !mddev->bitmap_ops->blocks_synced(mddev, sh->sector)))
> +		force_rcw = true;
>   
>   	if (test_bit(R5_LOCKED, &dev->flags) ||
>   	    test_bit(R5_UPTODATE, &dev->flags))

-- 
Thanks,
Nan

Re: [PATCH 0/2] md/md-llbimtap: fix two corner case problems

[Yu Kuai]

Hi，

在 2026/1/24 11:38, Jens Axboe 写道:
> On 1/23/26 11:26 AM, Yu Kuai wrote:
>> Yu Kuai (2):
>>    md/raid5: fix IO hang with degraded array with llbitmap
>>    md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout
>>
>>   drivers/md/md-llbitmap.c | 4 +++-
>>   drivers/md/raid5.c       | 7 ++++++-
>>   2 files changed, 9 insertions(+), 2 deletions(-)
> Is this just for review, or do you want them picked up off the list
> too?
>
> Both look fine to me, fwiw.

I'll send a pull request soon.

Sorry for the noise, I used the wrong script that is used to send pull
request for this set.

>
-- 
Thansk,
Kuai