From 73b0df929494522acf9ccc8dafea4f721166965b Mon Sep 17 00:00:00 2001 From: Sang-Hoon Choi Date: Wed, 30 Sep 2026 02:37:38 +0900 Subject: [PATCH] md/raid5: protect big_stripe_tree lookup with RCU big_stripe_tree is updated under tree_lock, and deleted radix-tree nodes are freed after an RCU grace period. r5c_big_stripe_cached() used to run under an RCU read-side critical section, but that protection was removed together with unrelated rdev lookup protection. The lookup can now be preempted while walking the tree, allowing a concurrent deletion and grace period to complete before the walk resumes. Protect the lookup locally with rcu_read_lock(). Only the presence of the entry is used after unlocking. Fixes: ad8606702f26 ("md/raid5: remove rcu protection to access rdev from conf") Assisted-by: LLM Signed-off-by: Sang-Hoon Choi Link: https://patch.msgid.link/179070265341.12871.12495446593114993799.idr-bug-88@gmail.com Signed-off-by: Yu Kuai --- drivers/md/raid5-cache.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c index 656c22b8e07e..785ddcb17e9e 100644 --- a/drivers/md/raid5-cache.c +++ b/drivers/md/raid5-cache.c @@ -2968,7 +2968,9 @@ bool r5c_big_stripe_cached(struct r5conf *conf, sector_t sect) return false; tree_index = r5c_tree_index(conf, sect); + rcu_read_lock(); slot = radix_tree_lookup(&log->big_stripe_tree, tree_index); + rcu_read_unlock(); return slot != NULL; }