md/md-bitmap: hold 'reconfig_mutex' in backlog_store()

Several reasons why 'reconfig_mutex' should be held:

1) rdev_for_each() is not safe to be called without the lock, because
   rdev can be removed concurrently.
2) mddev_destroy_serial_pool() and mddev_create_serial_pool() should not
   be called concurrently.
3) mddev_suspend() from mddev_destroy/create_serial_pool() should be
   protected by the lock.

Fixes: 10c92fca636e ("md-bitmap: create and destroy wb_info_pool with the change of backlog")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20230706083727.608914-3-yukuai1@huaweicloud.com
Signed-off-by: Song Liu <song@kernel.org>

diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index 1f33399..6f9ff14 100644 (file)
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2546,6 +2546,10 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
        if (backlog > COUNTER_MAX)
                return -EINVAL;
 
+       rv = mddev_lock(mddev);
+       if (rv)
+               return rv;
+
        /*
         * Without write mostly device, it doesn't make sense to set
         * backlog for max_write_behind.
@@ -2559,6 +2563,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
        if (!has_write_mostly) {
                pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n",
                                    mdname(mddev));
+               mddev_unlock(mddev);
                return -EINVAL;
        }
 
@@ -2574,6 +2579,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
        }
        if (old_mwb != backlog)
                md_bitmap_update_sb(mddev->bitmap);
+
+       mddev_unlock(mddev);
        return len;
 }