kernel/linux.git/drivers/md/md-cluster.c, branch v6.12.101

md-cluster: fix NULL pointer dereference in process_metadata_update

2026-03-04T12:20:55+00:00

[ Upstream commit f150e753cb8dd756085f46e86f2c35ce472e0a3c ] The function process_metadata_update() blindly dereferences the 'thread' pointer (acquired via rcu_dereference_protected) within the wait_event() macro. While the code comment states "daemon thread must exist", there is a valid race condition window during the MD array startup sequence (md_run): 1. bitmap_load() is called, which invokes md_cluster_ops->join(). 2. join() starts the "cluster_recv" thread (recv_daemon). 3. At this point, recv_daemon is active and processing messages. 4. However, mddev->thread (the main MD thread) is not initialized until later in md_run(). If a METADATA_UPDATED message is received from a remote node during this specific window, process_metadata_update() will be called while mddev->thread is still NULL, leading to a kernel panic. To fix this, we must validate the 'thread' pointer. If it is NULL, we release the held lock (no_new_dev_lockres) and return early, safely ignoring the update request as the array is not yet fully ready to process it. Link: https://lore.kernel.org/linux-raid/20260117145903.28921-1-jiashengjiangcool@gmail.com Signed-off-by: Jiasheng Jiang Signed-off-by: Yu Kuai Signed-off-by: Sasha Levin

md/md-bitmap: make in memory structure internal

2024-08-27T19:43:16+00:00

Now that struct bitmap_page and bitmap is not used externally anymore, move them from md-bitmap.h to md-bitmap.c (expect that dm-raid is still using define marco 'COUNTER_MAX'). Also fix some checkpatch warnings. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240826074452.1490072-43-yukuai1@huaweicloud.com Signed-off-by: Song Liu

md/md-bitmap: merge md_bitmap_free() into bitmap_operations

2024-08-27T19:43:15+00:00

So that the implementation won't be exposed, and it'll be possible o invent a new bitmap by replacing bitmap_operations. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240826074452.1490072-40-yukuai1@huaweicloud.com Signed-off-by: Song Liu

md/md-bitmap: merge md_bitmap_set_pages() into struct bitmap_operations

2024-08-27T19:43:15+00:00

o that the implementation won't be exposed, and it'll be possible o invent a new bitmap by replacing bitmap_operations. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240826074452.1490072-39-yukuai1@huaweicloud.com Signed-off-by: Song Liu

md/md-bitmap: merge md_bitmap_copy_from_slot() into struct bitmap_operation.

2024-08-27T19:43:15+00:00

So that the implementation won't be exposed, and it'll be possible to invent a new bitmap by replacing bitmap_operations. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240826074452.1490072-38-yukuai1@huaweicloud.com Signed-off-by: Song Liu

md/md-bitmap: merge get_bitmap_from_slot() into bitmap_operations

2024-08-27T19:43:15+00:00

md/md-bitmap: merge md_bitmap_resize() into bitmap_operations

2024-08-27T19:43:15+00:00

md/md-bitmap: pass in mddev directly for md_bitmap_resize()

2024-08-27T19:43:15+00:00

And move the condition "if (mddev->bitmap)" into md_bitmap_resize() as well, on the one hand make code cleaner, on the other hand try not to access bitmap directly. Since we are here, also change the parameter 'init' from int to bool. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20240826074452.1490072-35-yukuai1@huaweicloud.com Signed-off-by: Song Liu

md/md-bitmap: merge md_bitmap_sync_with_cluster() into bitmap_operations

2024-08-27T19:43:14+00:00

md/md-bitmap: merge md_bitmap_status() into bitmap_operations

2024-08-27T17:14:16+00:00