Mikulas Patocka a452744bcb crash in md-raid1 and md-raid10 due to incorrect list manipulation ... The commit 55ce74d4bf (md/raid1: ensure device failure recorded before write request returns) is causing crash in the LVM2 testsuite test shell/lvchange-raid.sh. For me the crash is 100% reproducible. The reason for the crash is that the newly added code in raid1d moves the list from conf->bio_end_io_list to tmp, then tests if tmp is non-empty and then incorrectly pops the bio from conf->bio_end_io_list (which is empty because the list was alrady moved). Raid-10 has a similar bug. Kernel Fault: Code=15 regs=000000006ccb8640 (Addr=0000000100000000) CPU: 3 PID: 1930 Comm: mdX_raid1 Not tainted 4.2.0-rc5-bisect+ #35 task: 000000006cc1f258 ti: 000000006ccb8000 task.ti: 000000006ccb8000 YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI PSW: 00001000000001001111111000001111 Not tainted r00-03 000000ff0804fe0f 000000001059d000 000000001059f818 000000007f16be38 r04-07 000000001059d000 000000007f16be08 0000000000200200 0000000000000001 r08-11 000000006ccb8260 000000007b7934d0 0000000000000001 0000000000000000 r12-15 000000004056f320 0000000000000000 0000000000013dd0 0000000000000000 r16-19 00000000f0d00ae0 0000000000000000 0000000000000000 0000000000000001 r20-23 000000000800000f 0000000042200390 0000000000000000 0000000000000000 r24-27 0000000000000001 000000000800000f 000000007f16be08 000000001059d000 r28-31 0000000100000000 000000006ccb8560 000000006ccb8640 0000000000000000 sr00-03 0000000000249800 0000000000000000 0000000000000000 0000000000249800 sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 IASQ: 0000000000000000 0000000000000000 IAOQ: 000000001059f61c 000000001059f620 IIR: 0f8010c6 ISR: 0000000000000000 IOR: 0000000100000000 CPU: 3 CR30: 000000006ccb8000 CR31: 0000000000000000 ORIG_R28: 000000001059d000 IAOQ[0]: call_bio_endio+0x34/0x1a8 [raid1] IAOQ[1]: call_bio_endio+0x38/0x1a8 [raid1] RP(r2): raid_end_bio_io+0x88/0x168 [raid1] Backtrace: [<000000001059f818>] raid_end_bio_io+0x88/0x168 [raid1] [<00000000105a4f64>] raid1d+0x144/0x1640 [raid1] [<000000004017fd5c>] kthread+0x144/0x160 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Fixes: 55ce74d4bf ("md/raid1: ensure device failure recorded before write request returns.") Fixes: 95af587e95 ("md/raid10: ensure device failure recorded before write request returns.") Signed-off-by: NeilBrown <neilb@suse.com>		2015-10-09 08:33:46 +11:00
..
bcache	bcache: remove driver private bio splitting code	2015-08-13 12:31:40 -06:00
persistent-data	dm: remove unlikely() before IS_ERR()	2015-08-12 11:32:21 -04:00
bitmap.c	md/bitmap: don't pass -1 to bitmap_storage_alloc.	2015-10-02 17:24:13 +10:00
bitmap.h	md-cluster: re-add capabilities	2015-04-22 07:59:39 +10:00
dm-bio-prison.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm-bio-prison.h	dm bio prison: add dm_cell_promote_or_release()	2015-05-29 14:19:06 -04:00
dm-bio-record.h	dm: Refactor for new bio cloning/splitting	2013-11-23 22:33:55 -08:00
dm-bufio.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm-bufio.h	dm snapshot: use dm-bufio prefetch	2014-01-14 23:23:03 -05:00
dm-builtin.c	dm sysfs: fix a module unload race	2014-01-14 23:23:04 -05:00
dm-cache-block-types.h	dm cache: revert "remove remainder of distinct discard block size"	2014-11-10 15:25:30 -05:00
dm-cache-metadata.c	dm cache: add fail io mode and needs_check flag	2015-06-11 17:13:00 -04:00
dm-cache-metadata.h	dm cache: add fail io mode and needs_check flag	2015-06-11 17:13:00 -04:00
dm-cache-policy-cleaner.c	dm cache: pass a new 'critical' flag to the policies when requesting writeback work	2015-05-29 14:19:04 -04:00
dm-cache-policy-internal.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-policy-mq.c	dm cache policy smq: move 'dm-cache-default' module alias to SMQ	2015-08-12 11:27:29 -04:00
dm-cache-policy-smq.c	dm cache policy smq: change the mutex to a spinlock	2015-08-12 11:32:19 -04:00
dm-cache-policy.c	dm cache: add policy name to status output	2014-01-16 13:44:11 -05:00
dm-cache-policy.h	dm cache: age and write back cache entries even without active IO	2015-06-11 17:13:01 -04:00
dm-cache-target.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-crypt.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-delay.c	dm: do not override error code returned from dm_get_device()	2015-08-12 11:32:21 -04:00
dm-era-target.c	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
dm-exception-store.c
dm-exception-store.h
dm-flakey.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-io.c	block: remove bio_get_nr_vecs()	2015-08-13 12:32:04 -06:00
dm-ioctl.c	char: make misc_deregister a void function	2015-08-05 10:35:49 -07:00
dm-kcopyd.c	dm: stop using WQ_NON_REENTRANT	2013-08-23 09:02:13 -04:00
dm-linear.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-log-userspace-base.c	dm log userspace base: fix compile warning	2015-04-15 12:10:20 -04:00
dm-log-userspace-transfer.c	dm log userspace transfer: match wait_for_completion_timeout return type	2015-04-15 12:10:20 -04:00
dm-log-userspace-transfer.h
dm-log-writes.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-log.c
dm-mpath.c	dm-mpath, scsi_dh: request scsi_dh modules in scsi_dh, not dm-mpath	2015-08-28 13:14:55 -07:00
dm-mpath.h
dm-path-selector.c
dm-path-selector.h
dm-queue-length.c
dm-raid1.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-raid.c	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
dm-region-hash.c	block: Abstract out bvec iterator	2013-11-23 22:33:47 -08:00
dm-round-robin.c
dm-service-time.c
dm-snap-persistent.c	dm: remove unlikely() before IS_ERR()	2015-08-12 11:32:21 -04:00
dm-snap-transient.c
dm-snap.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-stats.c	dm stats: report precise_timestamps and histogram in @stats_list output	2015-08-18 17:20:03 -04:00
dm-stats.h	dm stats: support precise timestamps	2015-06-17 12:40:40 -04:00
dm-stripe.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-switch.c	dm switch: efficiently support repetitive patterns	2014-08-01 12:30:37 -04:00
dm-sysfs.c	dm: add 'use_blk_mq' module param and expose in per-device ro sysfs attr	2015-04-15 12:10:17 -04:00
dm-table.c	block: Replace SG_GAPS with new queue limits mask	2015-08-19 14:26:02 -07:00
dm-target.c	dm: allocate requests in target when stacking on blk-mq devices	2015-02-09 13:06:47 -05:00
dm-thin-metadata.c	dm thin metadata: delete btrees when releasing metadata snapshot	2015-08-12 10:42:51 -04:00
dm-thin-metadata.h	dm thin metadata: add dm_thin_remove_range()	2015-06-11 17:13:04 -04:00
dm-thin.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-uevent.c
dm-uevent.h
dm-verity.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm-zero.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
dm.c	Merge tag 'dm-4.3-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm	2015-09-02 16:35:26 -07:00
dm.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
faulty.c	block: add a bi_error field to struct bio	2015-07-29 08:55:15 -06:00
Kconfig	SCSI misc on 20150911	2015-09-11 18:15:18 -07:00
linear.c	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
linear.h
Makefile	dm cache: add stochastic-multi-queue (smq) policy	2015-06-11 17:12:59 -04:00
md-cluster.c	md-cluster: remove inappropriate try_module_get from join()	2015-08-31 19:43:17 +02:00
md-cluster.h	Fix read-balancing during node failure	2015-07-24 13:37:59 +10:00
md.c	md: clear CHANGE_PENDING in readonly array	2015-10-02 17:23:44 +10:00
md.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
multipath.c	md: drop null test before destroy functions	2015-10-02 17:23:44 +10:00
multipath.h
raid0.c	md/raid0: apply base queue limits *before* disk_stack_limits	2015-10-02 17:23:44 +10:00
raid0.h	block: kill merge_bvec_fn() completely	2015-08-13 12:31:57 -06:00
raid1.c	crash in md-raid1 and md-raid10 due to incorrect list manipulation	2015-10-09 08:33:46 +11:00
raid1.h	md/raid1: ensure device failure recorded before write request returns.	2015-08-31 19:43:23 +02:00
raid5.c	md: drop null test before destroy functions	2015-10-02 17:23:44 +10:00
raid5.h	md/raid5: ensure device failure recorded before write request returns.	2015-08-31 19:43:59 +02:00
raid10.c	crash in md-raid1 and md-raid10 due to incorrect list manipulation	2015-10-09 08:33:46 +11:00
raid10.h	md/raid10: ensure device failure recorded before write request returns.	2015-08-31 19:43:45 +02:00