raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang
authorNate Dailey <>
Mon, 29 Feb 2016 15:43:58 +0000 (10:43 -0500)
committerBen Hutchings <>
Sat, 30 Apr 2016 22:05:19 +0000 (00:05 +0200)
commit ccfc7bf1f09d6190ef86693ddc761d5fe3fa47cb upstream.

If raid1d is handling a mix of read and write errors, handle_read_error's
call to freeze_array can get stuck.

This can happen because, though the bio_end_io_list is initially drained,
writes can be added to it via handle_write_finished as the retry_list
is processed. These writes contribute to nr_pending but are not included
in nr_queued.

If a later entry on the retry_list triggers a call to handle_read_error,
freeze array hangs waiting for nr_pending == nr_queued+extra. The writes
on the bio_end_io_list aren't included in nr_queued so the condition will
never be satisfied.

To prevent the hang, include bio_end_io_list writes in nr_queued.

There's probably a better way to handle decrementing nr_queued, but this
seemed like the safest way to avoid breaking surrounding code.

I'm happy to supply the script I used to repro this hang.

Fixes: 55ce74d4bfe1b(md/raid1: ensure device failure recorded before write request returns.)
Signed-off-by: Nate Dailey <>
Signed-off-by: Shaohua Li <>
Signed-off-by: Ben Hutchings <>

index 5c8dd40..7b75a19 100644 (file)
@@ -1976,6 +1976,7 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
        if (fail) {
                list_add(&r1_bio->retry_list, &conf->bio_end_io_list);
+               conf->nr_queued++;
        } else {
@@ -2090,8 +2091,10 @@ static void raid1d(struct mddev *mddev)
                spin_lock_irqsave(&conf->device_lock, flags);
                if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
-                       list_add(&tmp, &conf->bio_end_io_list);
-                       list_del_init(&conf->bio_end_io_list);
+                       while (!list_empty(&conf->bio_end_io_list)) {
+                               list_move(conf->bio_end_io_list.prev, &tmp);
+                               conf->nr_queued--;
+                       }
                spin_unlock_irqrestore(&conf->device_lock, flags);
                while (!list_empty(&tmp)) {