md/raid1: protect head_position for read balance

KCSAN reports a data race between raid1_end_read_request() and
raid1_read_request().

The completion path updates conf->mirrors[disk].head_position in
update_head_pos() without a lock, while the read-balance heuristic reads
the same field locklessly in is_sequential() and choose_best_rdev().

KCSAN report:
=========================
  BUG: KCSAN: data-race in raid1_end_read_request / raid1_read_request

  write to 0xffff8f0306ba7868 of 8 bytes by interrupt on cpu 9:
    raid1_end_read_request+0xb5/0x440
    bio_endio+0x3c9/0x3e0
    blk_update_request+0x257/0x770
    scsi_end_request+0x4d/0x520
    scsi_io_completion+0x6f/0x990
    scsi_finish_command+0x188/0x280
    scsi_complete+0xac/0x160
    blk_complete_reqs+0x8e/0xb0
    blk_done_softirq+0x1d/0x30
   [...]

  read to 0xffff8f0306ba7868 of 8 bytes by task 667002 on cpu 11:
    raid1_read_request+0x497/0x1a10
    raid1_make_request+0xdf/0x1950
    md_handle_request+0x2c5/0x700
    md_submit_bio+0x126/0x320
    __submit_bio+0x2ec/0x3a0
    submit_bio_noacct_nocheck+0x572/0x890
   [...]

  value changed: 0x0000000000000078 -> 0x00000000005fe448

Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Link: https://patch.msgid.link/20260619044114.1208456-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 41d9094fa50a7093c46e73da9c2acbebf880e220..afe2ca96ad8c2224535df41b187876c37cb66879 100644 (file)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -359,8 +359,8 @@ static inline void update_head_pos(int disk, struct r1bio *r1_bio)
 {
        struct r1conf *conf = r1_bio->mddev->private;
 
-       conf->mirrors[disk].head_position =
-               r1_bio->sector + (r1_bio->sectors);
+       WRITE_ONCE(conf->mirrors[disk].head_position,
+                  r1_bio->sector + r1_bio->sectors);
 }
 
 /*
@@ -737,7 +737,7 @@ static bool is_sequential(struct r1conf *conf, int disk, struct r1bio *r1_bio)
 {
        /* TODO: address issues with this check and concurrency. */
        return conf->mirrors[disk].next_seq_sect == r1_bio->sector ||
-              conf->mirrors[disk].head_position == r1_bio->sector;
+              READ_ONCE(conf->mirrors[disk].head_position) == r1_bio->sector;
 }
 
 /*
@@ -814,7 +814,8 @@ static int choose_best_rdev(struct r1conf *conf, struct r1bio *r1_bio)
                        set_bit(R1BIO_FailFast, &r1_bio->state);
 
                pending = atomic_read(&rdev->nr_pending);
-               dist = abs(r1_bio->sector - conf->mirrors[disk].head_position);
+               dist = abs(r1_bio->sector -
+                          READ_ONCE(conf->mirrors[disk].head_position));
 
                /* Don't change to another disk for sequential reads */
                if (is_sequential(conf, disk, r1_bio)) {