[PATCH 0/2] md/raid5: fix PPL disk add and replacement removal

[Yingjie Wang <x-professor@outlook.com>]

This series fixes two independent PPL disk-transition bugs.

When a newly added disk fails PPL setup, raid5_add_disk() can publish
the private disk pointer before the caller rolls back raid_disk. A later
removal can then free the disk while RAID5 still references it. Patch 1
prepares the PPL log before publishing the pointer and restores the
previous state on failure.

Patch 2 keeps the active PPL log attached when an unpromoted replacement
is removed. Without it, writes to the slot take the -EAGAIN path in
ppl_write_stripe() and are dispatched without PPL protection.

These fixes are independent of the separate replacement-activation work
and can be applied on their own.

Tested on x86_64 at the final commit:

  * per-commit W=1 KASAN+PROVE_LOCKING bzImage builds;
  * deterministic add rollback with -ENOSPC; and
  * removal of an unpromoted replacement, with entry/return kprobes on
    ppl_write_stripe().

On the unpatched md-7.4 base, the add-rollback test triggers a KASAN
slab-use-after-free in handle_stripe(), and the replacement-removal test
observes only -EAGAIN returns from ppl_write_stripe(). The final series
completes the add-rollback test and records a successful PPL write after
replacement removal. No KASAN, BUG, WARNING, Oops, or lockdep report was
observed on the fixed kernel.

All runtime tests used metadata=1.2. Empty-header -EIO injection and an
IMSM external-metadata runtime test were not run.

Yingjie Wang (2):
  md/raid5: roll back failed PPL disk additions
  md/raid5: preserve active PPL log when removing a replacement

 drivers/md/raid5-ppl.c | 11 ++++++++++-
 drivers/md/raid5.c     | 13 +++++++++----
 2 files changed, 19 insertions(+), 5 deletions(-)


base-commit: 47e1b18f38d74015cb9fd30b5ff2a1eb88e77d31
-- 
2.43.0