md/raid1: fix writes_pending and barrier reference leaks on write failures

raid1_make_request() acquires a writes_pending reference with
md_write_start() before calling raid1_write_request(). Several failure
paths in raid1_write_request() complete the bio and return without
reaching the normal write completion path, causing the corresponding
md_write_end() to be skipped.

Make raid1_write_request() return a status indicating whether the write
request was successfully queued. This allows raid1_make_request() to
call md_write_end() when raid1_write_request() fails.

Additionally, if wait_blocked_rdev() fails after wait_barrier()
succeeds, the associated barrier reference is not released.

Call allow_barrier() before returning from that path to keep the barrier
accounting balanced.

Fixes: b1a7ad8b5c4f ("md/raid1: Handle bio_split() errors")
Fixes: f2a38abf5f1c ("md/raid1: Atomic write support")
Fixes: 5aa705039c4f ("md: raid1 add nowait support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260611083514.754922-1-abd.masalkhi@gmail.com?part=1
Closes: https://sashiko.dev/#/patchset/20260611132500.763528-1-abd.masalkhi@gmail.com?part=1
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
Link: https://patch.msgid.link/20260613182810.1317258-2-abd.masalkhi@gmail.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 5b9368bd9e700e46d44966b8b64ef4d2708bce8e..632d72607e11e83ee0051b354b641564b8302949 100644 (file)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1501,7 +1501,7 @@ static void raid1_start_write_behind(struct mddev *mddev, struct r1bio *r1_bio,
 
 }
 
-static void raid1_write_request(struct mddev *mddev, struct bio *bio,
+static bool raid1_write_request(struct mddev *mddev, struct bio *bio,
                                int max_write_sectors)
 {
        struct r1conf *conf = mddev->private;
@@ -1512,6 +1512,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
        int max_sectors;
        bool write_behind = false;
        bool is_discard = (bio_op(bio) == REQ_OP_DISCARD);
+       sector_t sector = bio->bi_iter.bi_sector;
 
        if (mddev_is_clustered(mddev) &&
            mddev->cluster_ops->area_resyncing(mddev, WRITE,
@@ -1519,7 +1520,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
 
                if (bio->bi_opf & REQ_NOWAIT) {
                        bio_wouldblock_error(bio);
-                       return;
+                       return false;
                }
                wait_event_idle(conf->wait_barrier,
                                !mddev->cluster_ops->area_resyncing(mddev, WRITE,
@@ -1535,12 +1536,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
        if (!wait_barrier(conf, bio->bi_iter.bi_sector,
                                bio->bi_opf & REQ_NOWAIT)) {
                bio_wouldblock_error(bio);
-               return;
+               return false;
        }
 
        if (!wait_blocked_rdev(mddev, bio)) {
                bio_wouldblock_error(bio);
-               return;
+               allow_barrier(conf, sector);
+               return false;
        }
 
        r1_bio = alloc_r1bio(mddev, bio);
@@ -1699,7 +1701,8 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
 
        /* In case raid1d snuck in to freeze_array */
        wake_up_barrier(conf);
-       return;
+       return true;
+
 err_handle:
        for (k = 0; k < i; k++) {
                if (r1_bio->bios[k]) {
@@ -1709,6 +1712,7 @@ err_handle:
        }
 
        raid_end_bio_io(r1_bio);
+       return false;
 }
 
 static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
@@ -1732,8 +1736,9 @@ static bool raid1_make_request(struct mddev *mddev, struct bio *bio)
        if (bio_data_dir(bio) == READ)
                raid1_read_request(mddev, bio, sectors, NULL);
        else {
-               md_write_start(mddev,bio);
-               raid1_write_request(mddev, bio, sectors);
+               md_write_start(mddev, bio);
+               if (!raid1_write_request(mddev, bio, sectors))
+                       md_write_end(mddev);
        }
        return true;
 }