Patch "md/md-bitmap: fix incorrect usage for sb_index" has been added to the 6.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    md/md-bitmap: fix incorrect usage for sb_index

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-md-bitmap-fix-incorrect-usage-for-sb_index.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit fc14f88bf5b7b4e7604f343f05e1f443d7cdd42f
Author: Heming Zhao <heming.zhao@xxxxxxxx>
Date:   Fri Feb 23 20:11:28 2024 +0800

    md/md-bitmap: fix incorrect usage for sb_index
    
    [ Upstream commit ecbd8ebb51bf7e4939d83b9e6022a55cac44ef06 ]
    
    Commit d7038f951828 ("md-bitmap: don't use ->index for pages backing the
    bitmap file") removed page->index from bitmap code, but left wrong code
    logic for clustered-md. current code never set slot offset for cluster
    nodes, will sometimes cause crash in clustered env.
    
    Call trace (partly):
     md_bitmap_file_set_bit+0x110/0x1d8 [md_mod]
     md_bitmap_startwrite+0x13c/0x240 [md_mod]
     raid1_make_request+0x6b0/0x1c08 [raid1]
     md_handle_request+0x1dc/0x368 [md_mod]
     md_submit_bio+0x80/0xf8 [md_mod]
     __submit_bio+0x178/0x300
     submit_bio_noacct_nocheck+0x11c/0x338
     submit_bio_noacct+0x134/0x614
     submit_bio+0x28/0xdc
     submit_bh_wbc+0x130/0x1cc
     submit_bh+0x1c/0x28
    
    Fixes: d7038f951828 ("md-bitmap: don't use ->index for pages backing the bitmap file")
    Cc: stable@xxxxxxxxxxxxxxx # v6.6+
    Signed-off-by: Heming Zhao <heming.zhao@xxxxxxxx>
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240223121128.28985-1-heming.zhao@xxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 9672f75c30503..a4976ceae8688 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -234,7 +234,8 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap,
 	sector_t doff;
 
 	bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev;
-	if (pg_index == store->file_pages - 1) {
+	/* we compare length (page numbers), not page offset. */
+	if ((pg_index - store->sb_index) == store->file_pages - 1) {
 		unsigned int last_page_size = store->bytes & (PAGE_SIZE - 1);
 
 		if (last_page_size == 0)
@@ -438,8 +439,8 @@ static void filemap_write_page(struct bitmap *bitmap, unsigned long pg_index,
 	struct page *page = store->filemap[pg_index];
 
 	if (mddev_is_clustered(bitmap->mddev)) {
-		pg_index += bitmap->cluster_slot *
-			DIV_ROUND_UP(store->bytes, PAGE_SIZE);
+		/* go to node bitmap area starting point */
+		pg_index += store->sb_index;
 	}
 
 	if (store->file)
@@ -952,6 +953,7 @@ static void md_bitmap_file_set_bit(struct bitmap *bitmap, sector_t block)
 	unsigned long index = file_page_index(store, chunk);
 	unsigned long node_offset = 0;
 
+	index += store->sb_index;
 	if (mddev_is_clustered(bitmap->mddev))
 		node_offset = bitmap->cluster_slot * store->file_pages;
 
@@ -982,6 +984,7 @@ static void md_bitmap_file_clear_bit(struct bitmap *bitmap, sector_t block)
 	unsigned long index = file_page_index(store, chunk);
 	unsigned long node_offset = 0;
 
+	index += store->sb_index;
 	if (mddev_is_clustered(bitmap->mddev))
 		node_offset = bitmap->cluster_slot * store->file_pages;