md/raid1: free the r1bio before waiting for blocked rdev

Raid1 reshape will change mempool and r1conf::raid_disks which are
needed to free r1bio. allow_barrier() make a concurrent raid1_reshape()
possible. So, free the in-flight r1bio before waiting blocked rdev.

Fixes: 6bfe0b499082 ("md: support blocking writes to an array on device failure")
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Xueshi Hu <xueshi.hu@smartx.com>
Link: https://lore.kernel.org/r/20230814135356.1113639-3-xueshi.hu@smartx.com
Signed-off-by: Song Liu <song@kernel.org>

diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 642c8bae0df0cc4c805a692df0c63a06f3ac2516..b3fc44157cfcc00612cf26467d55a6c6a1bfe7ad 100644 (file)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1378,6 +1378,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                return;
        }
 
+ retry_write:
        r1_bio = alloc_r1bio(mddev, bio);
        r1_bio->sectors = max_write_sectors;
 
@@ -1393,7 +1394,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
         */
 
        disks = conf->raid_disks * 2;
- retry_write:
        blocked_rdev = NULL;
        rcu_read_lock();
        max_sectors = r1_bio->sectors;
@@ -1473,7 +1473,7 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio,
                for (j = 0; j < i; j++)
                        if (r1_bio->bios[j])
                                rdev_dec_pending(conf->mirrors[j].rdev, mddev);
-               r1_bio->state = 0;
+               free_r1bio(r1_bio);
                allow_barrier(conf, bio->bi_iter.bi_sector);
 
                if (bio->bi_opf & REQ_NOWAIT) {