From: Mariusz Tkaczyk Date: Thu, 14 Sep 2023 15:24:16 +0000 (+0200) Subject: md: Put the right device in md_seq_next X-Git-Tag: v6.1.61~862 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=98ea94f1627b6b5689ecb23bdd56673bef42e814;p=platform%2Fkernel%2Flinux-starfive.git md: Put the right device in md_seq_next commit c8870379a21fbd9ad14ca36204ccfbe9d25def43 upstream. If there are multiple arrays in system and one mddevice is marked with MD_DELETED and md_seq_next() is called in the middle of removal then it _get()s proper device but it may _put() deleted one. As a result, active counter may never be zeroed for mddevice and it cannot be removed. Put the device which has been _get with previous md_seq_next() call. Cc: stable@vger.kernel.org Fixes: 12a6caf27324 ("md: only delete entries from all_mddevs when the disk is freed") Reported-by: AceLan Kao Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217798 Cc: Yu Kuai Signed-off-by: Mariusz Tkaczyk Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20230914152416.10819-1-mariusz.tkaczyk@linux.intel.com Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/md/md.c b/drivers/md/md.c index 86b2acf..e87507d 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8228,7 +8228,7 @@ static void *md_seq_next(struct seq_file *seq, void *v, loff_t *pos) spin_unlock(&all_mddevs_lock); if (to_put) - mddev_put(mddev); + mddev_put(to_put); return next_mddev; }