Patch "md/md-bitmap: hold 'reconfig_mutex' in backlog_store()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    md/md-bitmap: hold 'reconfig_mutex' in backlog_store()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-md-bitmap-hold-reconfig_mutex-in-backlog_store.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 59872262e528223dc681421a755550dfcd04a900
Author: Yu Kuai <yukuai3@xxxxxxxxxx>
Date:   Thu Jul 6 16:37:27 2023 +0800

    md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
    
    [ Upstream commit 44abfa6a95df425c0660d56043020b67e6d93ab8 ]
    
    Several reasons why 'reconfig_mutex' should be held:
    
    1) rdev_for_each() is not safe to be called without the lock, because
       rdev can be removed concurrently.
    2) mddev_destroy_serial_pool() and mddev_create_serial_pool() should not
       be called concurrently.
    3) mddev_suspend() from mddev_destroy/create_serial_pool() should be
       protected by the lock.
    
    Fixes: 10c92fca636e ("md-bitmap: create and destroy wb_info_pool with the change of backlog")
    Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230706083727.608914-3-yukuai1@xxxxxxxxxxxxxxx
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index daedd9fcc4e5e..9354fd8618e3d 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2484,6 +2484,10 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
 	if (backlog > COUNTER_MAX)
 		return -EINVAL;
 
+	rv = mddev_lock(mddev);
+	if (rv)
+		return rv;
+
 	/*
 	 * Without write mostly device, it doesn't make sense to set
 	 * backlog for max_write_behind.
@@ -2497,6 +2501,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
 	if (!has_write_mostly) {
 		pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n",
 				    mdname(mddev));
+		mddev_unlock(mddev);
 		return -EINVAL;
 	}
 
@@ -2514,6 +2519,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
 	}
 	if (old_mwb != backlog)
 		md_bitmap_update_sb(mddev->bitmap);
+
+	mddev_unlock(mddev);
 	return len;
 }