AI Trajectory

Trajectory: (Expand/Collapse All)
Seq	Timestamp	Type	Name	Duration
0/0	2026/09/07 18:13	flow	patch-triage	0m Args: null Results: { "EnableConfigs": [ "BLK_DEV_MD", "MD_RAID1", "MD_RAID10", "MD_RAID456", "MD_LINEAR", "DM_RAID" ], "FocusSymbols": [ "mddev_stack_rdev_into", "mddev_update_io_opt", "md_add_new_disk", "remove_and_add_spares", "rdev_attr_store", "md_start_sync", "raid1_add_disk", "raid10_add_disk", "raid5_add_disk", "raid5_store_skip_copy", "linear_add" ], "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.", "NeedsKMSAN": false, "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.", "WorthFuzzing": true }
1/1	2026/09/07 18:13	action	read-patch-diff	0m Args: null Results: { "PatchDiff": "commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate: Mon Sep 7 18:13:15 2026 +0000\n\n syz-cluster: applied patch under review\n\ndiff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c\nindex 8f5a5e1342a95..21a1922bee4fb 100644\n--- a/drivers/md/dm-raid.c\n+++ b/drivers/md/dm-raid.c\n@@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set rs)\n \t\t\tclear_bit(Faulty, \u0026r-\u003eflags);\n \t\t\tclear_bit(WriteErrorSeen, \u0026r-\u003eflags);\n \n-\t\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, r)) {\n+\t\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, r, NULL)) {\n \t\t\t\t/ Failed to revive this device, try next /\n \t\t\t\tr-\u003eraid_disk = r-\u003esaved_raid_disk = -1;\n \t\t\t\tr-\u003eflags = flags;\ndiff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c\nindex 4b80165afd233..929513109657f 100644\n--- a/drivers/md/md-autodetect.c\n+++ b/drivers/md/md-autodetect.c\n@@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args args)\n \t\t\t\t(1 \u003c\u003c MD_DISK_ACTIVE) \| (1 \u003c\u003c MD_DISK_SYNC);\n \t\t}\n \n-\t\tmd_add_new_disk(mddev, \u0026dinfo);\n+\t\tmd_add_new_disk(mddev, \u0026dinfo, NULL);\n \t}\n \n \tif (!err)\ndiff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c\nindex 73b367b61b873..1f44c2d7db93d 100644\n--- a/drivers/md/md-linear.c\n+++ b/drivers/md/md-linear.c\n@@ -186,7 +186,8 @@ static int linear_run(struct mddev mddev)\n \treturn ret;\n }\n \n-static int linear_add(struct mddev mddev, struct md_rdev rdev)\n+static int linear_add(struct mddev mddev, struct md_rdev rdev,\n+\t\t struct queue_limits lim)\n {\n \t/* Adding a drive to a linear array allows the array to grow.\n \t * It is permitted if the new drive has a matching superblock\ndiff --git a/drivers/md/md.c b/drivers/md/md.c\nindex 680b34a63cb3d..c4054d06d1070 100644\n--- a/drivers/md/md.c\n+++ b/drivers/md/md.c\n@@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);\n /\n static struct workqueue_struct md_misc_wq;\n \n-static int remove_and_add_spares(struct mddev mddev,\n-\t\t\t\t struct md_rdev this);\n+static int remove_and_add_spares(struct mddev mddev, struct md_rdev this,\n+\t\t\t\t struct queue_limits lim);\n static void mddev_detach(struct mddev mddev);\n static void export_rdev(struct md_rdev rdev);\n static void md_wakeup_thread_directly(struct md_thread __rcu thread);\n@@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev mddev, int force_change)\n }\n EXPORT_SYMBOL(md_update_sb);\n \n-static int add_bound_rdev(struct md_rdev rdev)\n+static int add_bound_rdev(struct md_rdev rdev, struct queue_limits lim)\n {\n \tstruct mddev mddev = rdev-\u003emddev;\n \tint err = 0;\n@@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev rdev)\n \t\t /\n \t\tsuper_types[mddev-\u003emajor_version].\n \t\t\tvalidate_super(mddev, NULL/freshest/, rdev);\n-\t\terr = mddev-\u003epers-\u003ehot_add_disk(mddev, rdev);\n+\t\terr = mddev-\u003epers-\u003ehot_add_disk(mddev, rdev, lim);\n \t\tif (err) {\n \t\t\tmd_kick_rdev_from_array(rdev);\n \t\t\treturn err;\n@@ -3033,7 +3033,13 @@ static int cmd_match(const char cmd, const char str)\n struct rdev_sysfs_entry {\n \tstruct attribute attr;\n \tssize_t (show)(struct md_rdev , char );\n-\tssize_t (store)(struct md_rdev , const char , size_t);\n+\t/\n+\t @lim: a queue limits update the caller owns, or NULL. Stores that\n+\t * can add a leg to the array must stack into it rather than take\n+\t * q-\u003elimits_lock themselves, see md_start_sync().\n+\t /\n+\tssize_t (store)(struct md_rdev rdev, const char page, size_t len,\n+\t\t\t struct queue_limits lim);\n };\n \n static ssize_t\n@@ -3079,7 +3085,8 @@ state_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-state_store(struct md_rdev rdev, const char buf, size_t len)\n+state_store(struct md_rdev rdev, const char buf, size_t len,\n+\t struct queue_limits lim)\n {\n \t/* can write\n \t * faulty - simulates an error\n@@ -3110,7 +3117,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len)\n \t} else if (cmd_match(buf, \"remove\")) {\n \t\tif (rdev-\u003emddev-\u003epers) {\n \t\t\tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\t\t\tremove_and_add_spares(rdev-\u003emddev, rdev);\n+\t\t\tremove_and_add_spares(rdev-\u003emddev, rdev, lim);\n \t\t}\n \t\tif (rdev-\u003eraid_disk \u003e= 0)\n \t\t\terr = -EBUSY;\n@@ -3229,7 +3236,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len)\n \t\t\tif (!mddev_is_clustered(rdev-\u003emddev) \|\|\n \t\t\t (err = mddev-\u003ecluster_ops-\u003egather_bitmaps(rdev)) == 0) {\n \t\t\t\tclear_bit(Faulty, \u0026rdev-\u003eflags);\n-\t\t\t\terr = add_bound_rdev(rdev);\n+\t\t\t\terr = add_bound_rdev(rdev, lim);\n \t\t\t}\n \t\t} else\n \t\t\terr = -EBUSY;\n@@ -3257,7 +3264,8 @@ errors_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-errors_store(struct md_rdev rdev, const char buf, size_t len)\n+errors_store(struct md_rdev rdev, const char buf, size_t len,\n+\t struct queue_limits lim)\n {\n \tunsigned int n;\n \tint rv;\n@@ -3283,7 +3291,8 @@ slot_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-slot_store(struct md_rdev rdev, const char buf, size_t len)\n+slot_store(struct md_rdev rdev, const char buf, size_t len,\n+\t struct queue_limits lim)\n {\n \tint slot;\n \tint err;\n@@ -3314,7 +3323,7 @@ slot_store(struct md_rdev rdev, const char buf, size_t len)\n \t\tif (rdev-\u003emddev-\u003epers-\u003ehot_remove_disk == NULL)\n \t\t\treturn -EINVAL;\n \t\tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\t\tremove_and_add_spares(rdev-\u003emddev, rdev);\n+\t\tremove_and_add_spares(rdev-\u003emddev, rdev, lim);\n \t\tif (rdev-\u003eraid_disk \u003e= 0)\n \t\t\treturn -EBUSY;\n \t\tset_bit(MD_RECOVERY_NEEDED, \u0026rdev-\u003emddev-\u003erecovery);\n@@ -3344,7 +3353,8 @@ slot_store(struct md_rdev rdev, const char buf, size_t len)\n \t\t\trdev-\u003esaved_raid_disk = -1;\n \t\tclear_bit(In_sync, \u0026rdev-\u003eflags);\n \t\tclear_bit(Bitmap_sync, \u0026rdev-\u003eflags);\n-\t\terr = rdev-\u003emddev-\u003epers-\u003ehot_add_disk(rdev-\u003emddev, rdev);\n+\t\terr = rdev-\u003emddev-\u003epers-\u003ehot_add_disk(rdev-\u003emddev, rdev,\n+\t\t\t\t\t\t lim);\n \t\tif (err) {\n \t\t\trdev-\u003eraid_disk = -1;\n \t\t\treturn err;\n@@ -3377,7 +3387,8 @@ offset_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-offset_store(struct md_rdev rdev, const char buf, size_t len)\n+offset_store(struct md_rdev rdev, const char buf, size_t len,\n+\t struct queue_limits lim)\n {\n \tunsigned long long offset;\n \tif (kstrtoull(buf, 10, \u0026offset) \u003c 0)\n@@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t new_offset_store(struct md_rdev rdev,\n-\t\t\t\tconst char buf, size_t len)\n+\t\t\t\tconst char buf, size_t len,\n+\t\t\t\tstruct queue_limits lim)\n {\n \tunsigned long long new_offset;\n \tstruct mddev mddev = rdev-\u003emddev;\n@@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char buf, sector_t sectors)\n }\n \n static ssize_t\n-rdev_size_store(struct md_rdev rdev, const char buf, size_t len)\n+rdev_size_store(struct md_rdev rdev, const char buf, size_t len,\n+\t\tstruct queue_limits lim)\n {\n \tstruct mddev my_mddev = rdev-\u003emddev;\n \tsector_t oldsectors = rdev-\u003esectors;\n@@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev rdev, char page)\n \treturn sprintf(page, \"%llu\\n\", recovery_start);\n }\n \n-static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len)\n+static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len,\n+\t\t\t\t struct queue_limits lim)\n {\n \tunsigned long long recovery_start;\n \n@@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev rdev, char page)\n {\n \treturn badblocks_show(\u0026rdev-\u003ebadblocks, page, 0);\n }\n-static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len)\n+\n+static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len,\n+\t\t\tstruct queue_limits lim)\n {\n \tint rv = badblocks_store(\u0026rdev-\u003ebadblocks, page, len, 0);\n \t/* Maybe that ack was all we needed /\n@@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev rdev, char page)\n {\n \treturn badblocks_show(\u0026rdev-\u003ebadblocks, page, 1);\n }\n-static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len)\n+\n+static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len,\n+\t\t\t struct queue_limits lim)\n {\n \treturn badblocks_store(\u0026rdev-\u003ebadblocks, page, len, 1);\n }\n@@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-ppl_sector_store(struct md_rdev rdev, const char buf, size_t len)\n+ppl_sector_store(struct md_rdev rdev, const char buf, size_t len,\n+\t\t struct queue_limits lim)\n {\n \tunsigned long long sector;\n \n@@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev rdev, char page)\n }\n \n static ssize_t\n-ppl_size_store(struct md_rdev rdev, const char buf, size_t len)\n+ppl_size_store(struct md_rdev rdev, const char buf, size_t len,\n+\t struct queue_limits lim)\n {\n \tunsigned int size;\n \n@@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject kobj, struct attribute attr,\n \tstruct rdev_sysfs_entry entry = container_of(attr, struct rdev_sysfs_entry, attr);\n \tstruct md_rdev rdev = container_of(kobj, struct md_rdev, kobj);\n \tstruct kernfs_node kn = NULL;\n+\tstruct request_queue q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits limp = NULL;\n \tbool suspend = false;\n \tssize_t rv;\n \tstruct mddev mddev = READ_ONCE(rdev-\u003emddev);\n@@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject kobj, struct attribute attr,\n \t\t\tsuspend = true;\n \t}\n \n+\t/\n+\t These can add a leg back, which stacks its limits; the other\n+\t * state_store() values never reach -\u003ehot_add_disk(). q-\u003elimits_lock\n+\t * nests outside the lock and the suspend, see md_start_sync().\n+\t /\n+\tif ((entry-\u003estore == slot_store \|\|\n+\t (entry-\u003estore == state_store \u0026\u0026\n+\t (cmd_match(page, \"remove\") \|\| cmd_match(page, \"re-add\")))) \u0026\u0026\n+\t !mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \trv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);\n \tif (!rv) {\n \t\tif (rdev-\u003emddev == NULL)\n \t\t\trv = -ENODEV;\n \t\telse\n-\t\t\trv = entry-\u003estore(rdev, page, length);\n+\t\t\trv = entry-\u003estore(rdev, page, length, limp);\n+\t\t/ apply the limits before the array takes I/O again /\n+\t\tif (limp) {\n+\t\t\tqueue_limits_commit_update(q, limp);\n+\t\t\tlimp = NULL;\n+\t\t}\n \t\tsuspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev);\n \t}\n \n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n+\n \tif (kn)\n \t\tsysfs_unbreak_active_protection(kn);\n \n@@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev)\n }\n EXPORT_SYMBOL_GPL(mddev_stack_new_rdev);\n \n+/\n+ * Stack a new rdev into limits the caller already holds limits_lock for and\n+ * will commit itself. Used from paths that must take limits_lock before\n+ * quiescing the array, see md_start_sync().\n+ /\n+int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim)\n+{\n+\tstruct queue_limits tmp = lim;\n+\n+\tif (mddev_is_dm(mddev))\n+\t\treturn 0;\n+\n+\tif (queue_logical_block_size(rdev-\u003ebdev-\u003ebd_disk-\u003equeue) \u003e\n+\t queue_logical_block_size(mddev-\u003egendisk-\u003equeue)) {\n+\t\tpr_err(\"%s: incompatible logical_block_size, can not add\\n\",\n+\t\t mdname(mddev));\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tqueue_limits_stack_bdev(\u0026tmp, rdev-\u003ebdev, rdev-\u003edata_offset,\n+\t\t\t\tmddev-\u003egendisk-\u003edisk_name);\n+\n+\tif (!queue_limits_stack_integrity_bdev(\u0026tmp, rdev-\u003ebdev)) {\n+\t\tpr_err(\"%s: incompatible integrity profile for %pg\\n\",\n+\t\t mdname(mddev), rdev-\u003ebdev);\n+\t\treturn -ENXIO;\n+\t}\n+\n+\tlim = tmp;\n+\treturn 0;\n+}\n+EXPORT_SYMBOL_GPL(mddev_stack_rdev_into);\n+\n+/* for callers that must not wait for q-\u003elimits_lock, see md_start_sync() /\n+static bool mddev_stack_limits_trylock(struct mddev mddev,\n+\t\t\t\t struct queue_limits lim)\n+{\n+\tstruct request_queue q;\n+\n+\tif (mddev_is_dm(mddev))\n+\t\treturn false;\n+\n+\tq = mddev-\u003egendisk-\u003equeue;\n+\n+\treturn queue_limits_start_update_trylock(q, lim);\n+}\n+\n /* update the optimal I/O size after a reshape /\n-void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes)\n+void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes,\n+\t\t\t struct queue_limits lim)\n {\n-\tstruct queue_limits lim;\n+\tstruct queue_limits own;\n \n \tif (mddev_is_dm(mddev))\n \t\treturn;\n \n+\t/\n+\t With an update owned by the caller just change it in place; it is\n+\t * committed, and the array resumed, by whoever started it. Taking\n+\t * q-\u003elimits_lock here would nest it inside reconfig_mutex and the\n+\t * suspend, which deadlocks, see md_start_sync().\n+\t /\n+\tif (lim) {\n+\t\tlim-\u003eio_opt = lim-\u003eio_min nr_stripes;\n+\t\treturn;\n+\t}\n+\n+\t/\n+\t Called from the sync thread, which md_reap_sync_thread() waits for\n+\t * with reconfig_mutex held, so don't wait for q-\u003elimits_lock here.\n+\t * io_opt is a hint, skipping it on a contended pass is fine.\n+\t /\n+\tif (!mddev_stack_limits_trylock(mddev, \u0026own))\n+\t\treturn;\n+\n \t/ don't bother updating io_opt if we can't suspend the array /\n-\tif (mddev_suspend(mddev, false) \u003c 0)\n+\tif (mddev_suspend(mddev, false) \u003c 0) {\n+\t\tqueue_limits_cancel_update(mddev-\u003egendisk-\u003equeue);\n \t\treturn;\n-\tlim = queue_limits_start_update(mddev-\u003egendisk-\u003equeue);\n-\tlim.io_opt = lim.io_min nr_stripes;\n-\tqueue_limits_commit_update(mddev-\u003egendisk-\u003equeue, \u0026lim);\n+\t}\n+\town.io_opt = own.io_min * nr_stripes;\n+\tqueue_limits_commit_update(mddev-\u003egendisk-\u003equeue, \u0026own);\n \tmddev_resume(mddev);\n }\n EXPORT_SYMBOL_GPL(mddev_update_io_opt);\n@@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev mddev, void __user arg)\n \treturn 0;\n }\n \n-int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info)\n+int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info,\n+\t\t struct queue_limits lim)\n {\n \tstruct md_rdev rdev;\n \tdev_t dev = MKDEV(info-\u003emajor,info-\u003eminor);\n@@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info)\n \t\t\t\tif (err)\n \t\t\t\t\tmddev-\u003ecluster_ops-\u003eadd_new_disk_cancel(mddev);\n \t\t\t\telse\n-\t\t\t\t\terr = add_bound_rdev(rdev);\n+\t\t\t\t\terr = add_bound_rdev(rdev, lim);\n \t\t\t}\n \n \t\t} else if (!err)\n-\t\t\terr = add_bound_rdev(rdev);\n+\t\t\terr = add_bound_rdev(rdev, lim);\n \n \t\treturn err;\n \t}\n@@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info)\n \treturn 0;\n }\n \n-static int hot_remove_disk(struct mddev mddev, dev_t dev)\n+static int hot_remove_disk(struct mddev mddev, dev_t dev,\n+\t\t\t struct queue_limits lim)\n {\n \tstruct md_rdev rdev;\n \n@@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev mddev, dev_t dev)\n \t\tgoto kick_rdev;\n \n \tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\tremove_and_add_spares(mddev, rdev);\n+\tremove_and_add_spares(mddev, rdev, lim);\n \n \tif (rdev-\u003eraid_disk \u003e= 0)\n \t\tgoto busy;\n@@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd)\n \t}\n }\n \n+/\n+ * Commands that can reach -\u003ehot_add_disk(). ADD_NEW_DISK only does so for a\n+ * journal device or a personality without -\u003ehot_remove_disk, but that depends\n+ * on disk info still in user memory here, so it is included as a whole.\n+ /\n+static bool md_ioctl_may_add_disk(unsigned int cmd)\n+{\n+\tswitch (cmd) {\n+\tcase ADD_NEW_DISK:\n+\tcase HOT_REMOVE_DISK:\n+\t\treturn true;\n+\tdefault:\n+\t\treturn false;\n+\t}\n+}\n+\n static bool md_ioctl_need_suspend(unsigned int cmd)\n {\n \tswitch (cmd) {\n@@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \tunsigned int noio_flags = 0;\n \tvoid __user argp = (void __user )arg;\n \tstruct mddev mddev = NULL;\n+\tstruct request_queue q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits limp = NULL;\n \tbool suspend;\n \n \terr = md_ioctl_valid(cmd);\n@@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \tif (!md_is_rdwr(mddev))\n \t\tflush_work(\u0026mddev-\u003esync_work);\n \n+\t/* q-\u003elimits_lock nests outside both, see md_start_sync() /\n+\tif (md_ioctl_may_add_disk(cmd) \u0026\u0026 !mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \tsuspend = md_ioctl_need_suspend(cmd);\n \terr = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);\n \tif (err) {\n \t\tpr_debug(\"md: ioctl lock interrupted, reason %d, cmd %d\\n\",\n \t\t\t err, cmd);\n+\t\tif (limp)\n+\t\t\tqueue_limits_cancel_update(q);\n \t\tgoto out;\n \t}\n \tif (suspend)\n@@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \t\tgoto unlock;\n \n \tcase HOT_REMOVE_DISK:\n-\t\terr = hot_remove_disk(mddev, new_decode_dev(arg));\n+\t\terr = hot_remove_disk(mddev, new_decode_dev(arg), limp);\n \t\tgoto unlock;\n \n \tcase ADD_NEW_DISK:\n@@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \t\t\t\t/ Need to clear read-only for this /\n \t\t\t\tbreak;\n \t\t\telse\n-\t\t\t\terr = md_add_new_disk(mddev, \u0026info);\n+\t\t\t\terr = md_add_new_disk(mddev, \u0026info, limp);\n \t\t\tgoto unlock;\n \t\t}\n \t\tbreak;\n@@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \t\tif (copy_from_user(\u0026info, argp, sizeof(info)))\n \t\t\terr = -EFAULT;\n \t\telse\n-\t\t\terr = md_add_new_disk(mddev, \u0026info);\n+\t\t\terr = md_add_new_disk(mddev, \u0026info, limp);\n \t\tgoto unlock;\n \t}\n \n@@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode,\n \t err != -EINVAL)\n \t\tmddev-\u003ehold_active = 0;\n \n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n+\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\tmddev_unlock_and_resume(mddev);\n@@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev mddev, struct md_rdev this)\n \treturn removed;\n }\n \n-static int remove_and_add_spares(struct mddev mddev,\n-\t\t\t\t struct md_rdev this)\n+static int remove_and_add_spares(struct mddev mddev, struct md_rdev this,\n+\t\t\t\t struct queue_limits lim)\n {\n \tstruct md_rdev rdev;\n \tint spares = 0;\n@@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev mddev,\n \t\t\tcontinue;\n \t\tif (!test_bit(Journal, \u0026rdev-\u003eflags))\n \t\t\trdev-\u003erecovery_offset = 0;\n-\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, rdev) == 0) {\n+\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, rdev, lim) == 0) {\n \t\t\t/* failure here is OK /\n \t\t\tsysfs_link_rdev(mddev, rdev);\n \t\t\tif (!test_bit(Journal, \u0026rdev-\u003eflags))\n@@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev mddev,\n \treturn spares;\n }\n \n-static bool md_choose_sync_action(struct mddev mddev, int spares)\n+static bool md_choose_sync_action(struct mddev mddev, int spares,\n+\t\t\t\t struct queue_limits lim)\n {\n \t/ Check if reshape is in progress first. /\n \tif (mddev-\u003ereshape_position != MaxSector) {\n@@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev mddev, int spares)\n \t also removed and re-added, to allow the personality to fail the\n \t * re-add.\n \t /\n-\tspares = remove_and_add_spares(mddev, NULL);\n+\tspares = remove_and_add_spares(mddev, NULL, lim);\n \tif (spares \|\| test_bit(MD_RECOVERY_LAZY_RECOVER, \u0026mddev-\u003erecovery)) {\n \t\tclear_bit(MD_RECOVERY_SYNC, \u0026mddev-\u003erecovery);\n \t\tclear_bit(MD_RECOVERY_CHECK, \u0026mddev-\u003erecovery);\n@@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev mddev, int spares)\n static void md_start_sync(struct work_struct ws)\n {\n \tstruct mddev mddev = container_of(ws, struct mddev, sync_work);\n+\tstruct request_queue q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits limp = NULL;\n \tint spares = 0;\n \tbool suspend = false;\n \tunsigned int noio_flags = 0;\n@@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct ws)\n \t /\n \tif ((mddev-\u003ereshape_position == MaxSector \|\| !md_is_rdwr(mddev)) \u0026\u0026\n \t md_spares_need_change(mddev)) {\n+\t\t/\n+\t\t Adding a spare below stacks its limits, which needs\n+\t\t * q-\u003elimits_lock. Take it before suspending: its holder\n+\t\t * waits in blk_mq_freeze_queue() for I/O that\n+\t\t * mddev-\u003esuspended holds back, so the other order deadlocks.\n+\t\t /\n+\t\tif (!mddev_is_dm(mddev)) {\n+\t\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\t\tlim = queue_limits_start_update(q);\n+\t\t\tlimp = \u0026lim;\n+\t\t}\n \t\tsuspend = true;\n \t\tmddev_suspend(mddev, false);\n \t\tnoio_flags = memalloc_noio_save();\n@@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct ws)\n \tif (!suspend \u0026\u0026 (mddev-\u003ereshape_position == MaxSector \|\| !md_is_rdwr(mddev)) \u0026\u0026\n \t md_spares_need_change(mddev)) {\n \t\tmddev_unlock(mddev);\n+\t\t/* see above: q-\u003elimits_lock nests outside both /\n+\t\tif (!mddev_is_dm(mddev)) {\n+\t\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\t\tlim = queue_limits_start_update(q);\n+\t\t\tlimp = \u0026lim;\n+\t\t}\n \t\tmddev_suspend_and_lock_nointr(mddev);\n \t\tsuspend = true;\n \t\tnoio_flags = memalloc_noio_save();\n@@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct ws)\n \t\t * As we only add devices that are already in-sync, we can\n \t\t * activate the spares immediately.\n \t\t /\n-\t\tremove_and_add_spares(mddev, NULL);\n+\t\tremove_and_add_spares(mddev, NULL, limp);\n \t\tgoto not_running;\n \t}\n \n-\tif (!md_choose_sync_action(mddev, \u0026spares))\n+\tif (!md_choose_sync_action(mddev, \u0026spares, limp))\n \t\tgoto not_running;\n \n \tif (!mddev-\u003epers-\u003esync_request)\n@@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct ws)\n \t * https://bugzilla.kernel.org/show_bug.cgi?id=218200\n \t * Therefore, use __mddev_resume(mddev, false).\n \t /\n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\t__mddev_resume(mddev, false);\n@@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct ws)\n \t * https://bugzilla.kernel.org/show_bug.cgi?id=218200\n \t * Therefore, use __mddev_resume(mddev, false).\n \t /\n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\t__mddev_resume(mddev, false);\n@@ -10793,6 +10965,7 @@ static int __init md_init(void)\n \n static void check_sb_changes(struct mddev mddev, struct md_rdev rdev)\n {\n+\tstruct queue_limits lim;\n \tstruct mdp_superblock_1 sb = page_address(rdev-\u003esb_page);\n \tstruct md_rdev rdev2, tmp;\n \tint role, ret;\n@@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev mddev, struct md_rdev rdev)\n \t\t\t\t\trdev2-\u003esaved_raid_disk = -1;\n \t\t\t\telse\n \t\t\t\t\trdev2-\u003esaved_raid_disk = role;\n-\t\t\t\tret = remove_and_add_spares(mddev, rdev2);\n+\t\t\t\t/\n+\t\t\t\t reconfig_mutex is held, so don't wait for\n+\t\t\t\t * q-\u003elimits_lock; MD_RECOVERY_NEEDED below\n+\t\t\t\t * leaves a skipped add to md_start_sync().\n+\t\t\t\t /\n+\t\t\t\tif (mddev_stack_limits_trylock(mddev, \u0026lim)) {\n+\t\t\t\t\tstruct request_queue q =\n+\t\t\t\t\t\tmddev-\u003egendisk-\u003equeue;\n+\n+\t\t\t\t\tret = remove_and_add_spares(mddev,\n+\t\t\t\t\t\t\t\t rdev2, \u0026lim);\n+\t\t\t\t\tqueue_limits_commit_update(q, \u0026lim);\n+\t\t\t\t} else if (mddev_is_dm(mddev)) {\n+\t\t\t\t\tret = remove_and_add_spares(mddev,\n+\t\t\t\t\t\t\t\t rdev2, NULL);\n+\t\t\t\t} else {\n+\t\t\t\t\tret = remove_spares(mddev, rdev2);\n+\t\t\t\t}\n \t\t\t\tpr_info(\"Activated spare: %pg\\n\",\n \t\t\t\t\trdev2-\u003ebdev);\n \t\t\t\t/* wakeup mddev-\u003ethread here, so array could\ndiff --git a/drivers/md/md.h b/drivers/md/md.h\nindex b6d2e8929a0f9..ceca8cfcdcb9e 100644\n--- a/drivers/md/md.h\n+++ b/drivers/md/md.h\n@@ -765,7 +765,8 @@ struct md_personality\n \t * if appropriate, and should abort recovery if needed\n \t /\n \tvoid (error_handler)(struct mddev mddev, struct md_rdev rdev);\n-\tint (hot_add_disk) (struct mddev mddev, struct md_rdev rdev);\n+\tint (hot_add_disk)(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim);\n \tint (hot_remove_disk) (struct mddev mddev, struct md_rdev rdev);\n \tint (spare_active) (struct mddev mddev);\n \tsector_t (sync_request)(struct mddev mddev, sector_t sector_nr,\n@@ -1041,13 +1042,17 @@ struct mdu_disk_info_s;\n extern int mdp_major;\n void md_autostart_arrays(int part);\n int md_set_array_info(struct mddev mddev, struct mdu_array_info_s info);\n-int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info);\n+int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info,\n+\t\t struct queue_limits lim);\n int do_md_run(struct mddev mddev);\n #define MDDEV_STACK_INTEGRITY\t(1u \u003c\u003c 0)\n int mddev_stack_rdev_limits(struct mddev mddev, struct queue_limits lim,\n \t\tunsigned int flags);\n int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev);\n-void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes);\n+int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim);\n+void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes,\n+\t\t\t struct queue_limits lim);\n \n extern const struct block_device_operations md_fops;\n \ndiff --git a/drivers/md/raid1.c b/drivers/md/raid1.c\nindex f0646fb24371f..dd348b5695d06 100644\n--- a/drivers/md/raid1.c\n+++ b/drivers/md/raid1.c\n@@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf conf, int disk)\n \treturn true;\n }\n \n-static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev)\n+static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim)\n {\n \tstruct r1conf conf = mddev-\u003eprivate;\n \tint err = -EEXIST;\n@@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev)\n \tfor (mirror = first; mirror \u003c= last; mirror++) {\n \t\tp = conf-\u003emirrors + mirror;\n \t\tif (!p-\u003erdev) {\n-\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\t\tif (lim)\n+\t\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\t\telse\n+\t\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\t\tif (err)\n \t\t\t\treturn err;\n \ndiff --git a/drivers/md/raid10.c b/drivers/md/raid10.c\nindex 1093c798d9dde..641619328a6c4 100644\n--- a/drivers/md/raid10.c\n+++ b/drivers/md/raid10.c\n@@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev mddev)\n \treturn count;\n }\n \n-static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev)\n+static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim)\n {\n \tstruct r10conf conf = mddev-\u003eprivate;\n \tint err = -EEXIST;\n@@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev)\n \t\t\tcontinue;\n \t\t}\n \n-\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\tif (lim)\n+\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\telse\n+\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\tif (err)\n \t\t\treturn err;\n \t\tp-\u003ehead_position = 0;\n@@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev)\n \t\tclear_bit(In_sync, \u0026rdev-\u003eflags);\n \t\tset_bit(Replacement, \u0026rdev-\u003eflags);\n \t\trdev-\u003eraid_disk = repl_slot;\n-\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\tif (lim)\n+\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\telse\n+\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\tif (err)\n \t\t\treturn err;\n \t\tconf-\u003efullsync = 1;\n@@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev mddev)\n \t\trdev_for_each(rdev, mddev)\n \t\t\tif (rdev-\u003eraid_disk \u003c 0 \u0026\u0026\n \t\t\t !test_bit(Faulty, \u0026rdev-\u003eflags)) {\n-\t\t\t\tif (raid10_add_disk(mddev, rdev) == 0) {\n+\t\t\t\tif (raid10_add_disk(mddev, rdev, NULL) == 0) {\n \t\t\t\t\tif (rdev-\u003eraid_disk \u003e=\n \t\t\t\t\t conf-\u003eprev.raid_disks)\n \t\t\t\t\t\tset_bit(In_sync, \u0026rdev-\u003eflags);\n@@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf conf)\n \tconf-\u003ereshape_safe = MaxSector;\n \tspin_unlock_irq(\u0026conf-\u003edevice_lock);\n \n-\tmddev_update_io_opt(conf-\u003emddev, raid10_nr_stripes(conf));\n+\tmddev_update_io_opt(conf-\u003emddev, raid10_nr_stripes(conf), NULL);\n \tconf-\u003efullsync = 0;\n }\n \ndiff --git a/drivers/md/raid5.c b/drivers/md/raid5.c\nindex b91545ce090de..22759c631c4d9 100644\n--- a/drivers/md/raid5.c\n+++ b/drivers/md/raid5.c\n@@ -7288,6 +7288,9 @@ static ssize_t\n raid5_store_skip_copy(struct mddev mddev, const char page, size_t len)\n {\n \tstruct r5conf conf;\n+\tstruct request_queue q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits limp = NULL;\n \tunsigned long new;\n \tint err;\n \n@@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev mddev, const char page, size_t len)\n \t\treturn -EINVAL;\n \tnew = !!new;\n \n+\t/ q-\u003elimits_lock nests outside both, see md_start_sync() /\n+\tif (!mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \terr = mddev_suspend_and_lock(mddev);\n-\tif (err)\n+\tif (err) {\n+\t\tif (limp)\n+\t\t\tqueue_limits_cancel_update(q);\n \t\treturn err;\n+\t}\n \tconf = mddev-\u003eprivate;\n \tif (!conf)\n \t\terr = -ENODEV;\n \telse if (new != conf-\u003eskip_copy) {\n-\t\tstruct request_queue q = mddev-\u003egendisk-\u003equeue;\n-\t\tstruct queue_limits lim = queue_limits_start_update(q);\n-\n \t\tconf-\u003eskip_copy = new;\n-\t\tif (new)\n-\t\t\tlim.features \|= BLK_FEAT_STABLE_WRITES;\n-\t\telse\n-\t\t\tlim.features \u0026= ~BLK_FEAT_STABLE_WRITES;\n-\t\terr = queue_limits_commit_update(q, \u0026lim);\n+\t\tif (limp) {\n+\t\t\tif (new)\n+\t\t\t\tlimp-\u003efeatures \|= BLK_FEAT_STABLE_WRITES;\n+\t\t\telse\n+\t\t\t\tlimp-\u003efeatures \u0026= ~BLK_FEAT_STABLE_WRITES;\n+\t\t}\n \t}\n+\tif (limp)\n+\t\terr = queue_limits_commit_update(q, limp) ?: err;\n \tmddev_unlock_and_resume(mddev);\n \treturn err ?: len;\n }\n@@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev mddev, struct md_rdev rdev)\n \treturn err;\n }\n \n-static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev)\n+static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev,\n+\t\t\t struct queue_limits lim)\n {\n \tstruct r5conf conf = mddev-\u003eprivate;\n \tint ret, err = -EEXIST;\n@@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev mddev)\n \t\trdev_for_each(rdev, mddev)\n \t\t\tif (rdev-\u003eraid_disk \u003c 0 \u0026\u0026\n \t\t\t !test_bit(Faulty, \u0026rdev-\u003eflags)) {\n-\t\t\t\tif (raid5_add_disk(mddev, rdev) == 0) {\n+\t\t\t\tif (raid5_add_disk(mddev, rdev, NULL) == 0) {\n \t\t\t\t\tif (rdev-\u003eraid_disk\n \t\t\t\t\t \u003e= conf-\u003eprevious_raid_disks)\n \t\t\t\t\t\tset_bit(In_sync, \u0026rdev-\u003eflags);\n@@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf conf)\n \t\twake_up(\u0026conf-\u003ewait_for_reshape);\n \n \t\tmddev_update_io_opt(conf-\u003emddev,\n-\t\t\tconf-\u003eraid_disks - conf-\u003emax_degraded);\n+\t\t\tconf-\u003eraid_disks - conf-\u003emax_degraded, NULL);\n \t}\n }\n \ndiff --git a/include/linux/blkdev.h b/include/linux/blkdev.h\nindex 4f7905c3412b8..b75e85291e290 100644\n--- a/include/linux/blkdev.h\n+++ b/include/linux/blkdev.h\n@@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue q)\n \tmutex_lock(\u0026q-\u003elimits_lock);\n \treturn q-\u003elimits;\n }\n+\n+/\n+ queue_limits_start_update_trylock - try to start an atomic update of queue\n+ \tlimits\n+ @q:\t\tqueue to update\n+ * @lim:\treturns a snapshot of the current limits on success\n+ \n+ Like queue_limits_start_update(), but fails instead of waiting when another\n+ * update is in flight. For callers that must not block on q-\u003elimits_lock\n+ * because they hold something its current owner is waiting for.\n+ \n+ Context: process context.\n+ /\n+static inline bool\n+queue_limits_start_update_trylock(struct request_queue q,\n+\t\t\t\t struct queue_limits lim)\n+\t__cond_acquires(true, \u0026q-\u003elimits_lock)\n+{\n+\tif (!mutex_trylock(\u0026q-\u003elimits_lock))\n+\t\treturn false;\n+\n+\tlim = q-\u003elimits;\n+\n+\treturn true;\n+}\n+\n int queue_limits_commit_update_frozen(struct request_queue q,\n \t\tstruct queue_limits lim) __releases(\u0026q-\u003elimits_lock);\n int queue_limits_commit_update(struct request_queue *q,\n" }
2/1	2026/09/07 18:13	agent	patch-evaluator	0m Model: core Args: null Results: { "EnableConfigs": [ "BLK_DEV_MD", "MD_RAID1", "MD_RAID10", "MD_RAID456", "MD_LINEAR", "DM_RAID" ], "FocusSymbols": [ "mddev_stack_rdev_into", "mddev_update_io_opt", "md_add_new_disk", "remove_and_add_spares", "rdev_attr_store", "md_start_sync", "raid1_add_disk", "raid10_add_disk", "raid5_add_disk", "raid5_store_skip_copy", "linear_add" ], "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.", "WorthFuzzing": true } Instruction: You are an expert Linux kernel maintainer and security engineer. Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller. IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in your workspace. Do NOT rely on internal assumptions. You must actively use your code access tools to inspect the actual source code, callers, and surrounding context. ================================================================================ 1. CORE TRIAGE PHILOSOPHY ================================================================================ The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs, and newly triggered assertions introduced by the patch series. - REACHABILITY IS THE PRIMARY GATE: Fuzzing can only discover bugs in code that can actually execute in standard virtualized environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap). If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed, regardless of whether it adds assertions or complex logic. - DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS: Patch authors routinely label changes as "cleanups", "refactorings", or state "No functional change intended". Do NOT take these claims at face value. Code refactorings that rearrange logic, introduce helper functions, or alter state management in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs. If reachable executable code is modified or refactored, it MUST be fuzzed. - NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED: When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON, VM_WARN_ON, BUG_ON, lockdep_assert) in reachable code paths, it enforces new or stricter invariants. Even if the author believes the invariant always holds, fuzzing is essential to verify whether an unusual sequence of operations can violate it. ================================================================================ 2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA) ================================================================================ Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories: - Non-kernel and non-executable changes: * Modifications to Documentation/, comments, or spelling fixes. * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/) that do not affect the compiled kernel image (vmlinux) or kernel modules. * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints that do not alter control flow or data structures. * Build system or Kconfig changes that do not alter compiled C logic. - Structurally unreachable hardware: * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed, ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU. - Unreachable execution paths: * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during physical PCI hot-unplug or manual sysfs driver unbinding. * Code paths exclusive to architectures other than the target architecture. ================================================================================ 3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA) ================================================================================ Return WorthFuzzing=true whenever the patch touches reachable executable code, including: - Core Subsystems: * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/), BPF, scheduler, core networking, VFS, or syscall handling. - Refactorings and Code Cleanups: * Any restructuring of reachable data structures, helper abstractions, or algorithm flows. - Runtime Assertions and Defensive Checks: * Any introduction or alteration of assertions (WARN_ON, VM_WARN_ON, BUG_ON, etc.) in reachable paths. - Reachable Drivers and Protocols: Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.). ================================================================================ 4. EXTRACTING FocusSymbols (PREVENTING DILUTION) ================================================================================ When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer: - AVOID UBIQUITOUS LIFECYCLE HOT-PATHS: Do NOT list generic, ubiquitous functions called by almost every program in the corpus (including, but not limited to: general memory allocators and deallocators, page fault and trap handlers, or core synchronization primitives; this is not an exhaustive list). Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused", which severely dilutes fuzzing effort away from the actual changes. - TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS: List functions that specifically implement the logic being added or altered, or direct API entrypoints for the subsystem feature under review. - HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h): Compiler-inlined static functions (such as static inlines in mm/.h or include/linux/.h) lack distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters. If the changes are primarily in static inline helpers, identify non-static, feature-specific caller functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers). ================================================================================ 5. IDENTIFYING EnableConfigs ================================================================================ Identify any specific CONFIG_ options required to properly compile and reach the modified code: - Inspect Kconfig files and #ifdef guards; do not make assumptions. - Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed. - Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4"). Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e Author: syz-cluster <triage@syzkaller.com> Date: Mon Sep 7 18:13:15 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 8f5a5e1342a95..21a1922bee4fb 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set rs) clear_bit(Faulty, &r->flags); clear_bit(WriteErrorSeen, &r->flags); - if (mddev->pers->hot_add_disk(mddev, r)) { + if (mddev->pers->hot_add_disk(mddev, r, NULL)) { / Failed to revive this device, try next / r->raid_disk = r->saved_raid_disk = -1; r->flags = flags; diff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c index 4b80165afd233..929513109657f 100644 --- a/drivers/md/md-autodetect.c +++ b/drivers/md/md-autodetect.c @@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args args) (1 << MD_DISK_ACTIVE) \| (1 << MD_DISK_SYNC); } - md_add_new_disk(mddev, &dinfo); + md_add_new_disk(mddev, &dinfo, NULL); } if (!err) diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c index 73b367b61b873..1f44c2d7db93d 100644 --- a/drivers/md/md-linear.c +++ b/drivers/md/md-linear.c @@ -186,7 +186,8 @@ static int linear_run(struct mddev mddev) return ret; } -static int linear_add(struct mddev mddev, struct md_rdev rdev) +static int linear_add(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { /* Adding a drive to a linear array allows the array to grow. * It is permitted if the new drive has a matching superblock diff --git a/drivers/md/md.c b/drivers/md/md.c index 680b34a63cb3d..c4054d06d1070 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait); / static struct workqueue_struct md_misc_wq; -static int remove_and_add_spares(struct mddev mddev, - struct md_rdev this); +static int remove_and_add_spares(struct mddev mddev, struct md_rdev this, + struct queue_limits lim); static void mddev_detach(struct mddev mddev); static void export_rdev(struct md_rdev rdev); static void md_wakeup_thread_directly(struct md_thread __rcu thread); @@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev mddev, int force_change) } EXPORT_SYMBOL(md_update_sb); -static int add_bound_rdev(struct md_rdev rdev) +static int add_bound_rdev(struct md_rdev rdev, struct queue_limits lim) { struct mddev mddev = rdev->mddev; int err = 0; @@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev rdev) / super_types[mddev->major_version]. validate_super(mddev, NULL/freshest/, rdev); - err = mddev->pers->hot_add_disk(mddev, rdev); + err = mddev->pers->hot_add_disk(mddev, rdev, lim); if (err) { md_kick_rdev_from_array(rdev); return err; @@ -3033,7 +3033,13 @@ static int cmd_match(const char cmd, const char str) struct rdev_sysfs_entry { struct attribute attr; ssize_t (show)(struct md_rdev , char ); - ssize_t (store)(struct md_rdev , const char , size_t); + /* + * @lim: a queue limits update the caller owns, or NULL. Stores that + * can add a leg to the array must stack into it rather than take + * q->limits_lock themselves, see md_start_sync(). + / + ssize_t (store)(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim); }; static ssize_t @@ -3079,7 +3085,8 @@ state_show(struct md_rdev rdev, char page) } static ssize_t -state_store(struct md_rdev rdev, const char buf, size_t len) +state_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { /* can write * faulty - simulates an error @@ -3110,7 +3117,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len) } else if (cmd_match(buf, "remove")) { if (rdev->mddev->pers) { clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(rdev->mddev, rdev); + remove_and_add_spares(rdev->mddev, rdev, lim); } if (rdev->raid_disk >= 0) err = -EBUSY; @@ -3229,7 +3236,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len) if (!mddev_is_clustered(rdev->mddev) \|\| (err = mddev->cluster_ops->gather_bitmaps(rdev)) == 0) { clear_bit(Faulty, &rdev->flags); - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); } } else err = -EBUSY; @@ -3257,7 +3264,8 @@ errors_show(struct md_rdev rdev, char page) } static ssize_t -errors_store(struct md_rdev rdev, const char buf, size_t len) +errors_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned int n; int rv; @@ -3283,7 +3291,8 @@ slot_show(struct md_rdev rdev, char page) } static ssize_t -slot_store(struct md_rdev rdev, const char buf, size_t len) +slot_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { int slot; int err; @@ -3314,7 +3323,7 @@ slot_store(struct md_rdev rdev, const char buf, size_t len) if (rdev->mddev->pers->hot_remove_disk == NULL) return -EINVAL; clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(rdev->mddev, rdev); + remove_and_add_spares(rdev->mddev, rdev, lim); if (rdev->raid_disk >= 0) return -EBUSY; set_bit(MD_RECOVERY_NEEDED, &rdev->mddev->recovery); @@ -3344,7 +3353,8 @@ slot_store(struct md_rdev rdev, const char buf, size_t len) rdev->saved_raid_disk = -1; clear_bit(In_sync, &rdev->flags); clear_bit(Bitmap_sync, &rdev->flags); - err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev); + err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev, + lim); if (err) { rdev->raid_disk = -1; return err; @@ -3377,7 +3387,8 @@ offset_show(struct md_rdev rdev, char page) } static ssize_t -offset_store(struct md_rdev rdev, const char buf, size_t len) +offset_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long offset; if (kstrtoull(buf, 10, &offset) < 0) @@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev rdev, char page) } static ssize_t new_offset_store(struct md_rdev rdev, - const char buf, size_t len) + const char buf, size_t len, + struct queue_limits lim) { unsigned long long new_offset; struct mddev mddev = rdev->mddev; @@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char buf, sector_t sectors) } static ssize_t -rdev_size_store(struct md_rdev rdev, const char buf, size_t len) +rdev_size_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { struct mddev my_mddev = rdev->mddev; sector_t oldsectors = rdev->sectors; @@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev rdev, char page) return sprintf(page, "%llu\n", recovery_start); } -static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len) +static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long recovery_start; @@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev rdev, char page) { return badblocks_show(&rdev->badblocks, page, 0); } -static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len) + +static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim) { int rv = badblocks_store(&rdev->badblocks, page, len, 0); /* Maybe that ack was all we needed / @@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev rdev, char page) { return badblocks_show(&rdev->badblocks, page, 1); } -static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len) + +static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim) { return badblocks_store(&rdev->badblocks, page, len, 1); } @@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev rdev, char page) } static ssize_t -ppl_sector_store(struct md_rdev rdev, const char buf, size_t len) +ppl_sector_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long sector; @@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev rdev, char page) } static ssize_t -ppl_size_store(struct md_rdev rdev, const char buf, size_t len) +ppl_size_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned int size; @@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject kobj, struct attribute attr, struct rdev_sysfs_entry entry = container_of(attr, struct rdev_sysfs_entry, attr); struct md_rdev rdev = container_of(kobj, struct md_rdev, kobj); struct kernfs_node kn = NULL; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; bool suspend = false; ssize_t rv; struct mddev mddev = READ_ONCE(rdev->mddev); @@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject kobj, struct attribute attr, suspend = true; } + /* + * These can add a leg back, which stacks its limits; the other + * state_store() values never reach ->hot_add_disk(). q->limits_lock + * nests outside the lock and the suspend, see md_start_sync(). + / + if ((entry->store == slot_store \|\| + (entry->store == state_store && + (cmd_match(page, "remove") \|\| cmd_match(page, "re-add")))) && + !mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + rv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev); if (!rv) { if (rdev->mddev == NULL) rv = -ENODEV; else - rv = entry->store(rdev, page, length); + rv = entry->store(rdev, page, length, limp); + / apply the limits before the array takes I/O again / + if (limp) { + queue_limits_commit_update(q, limp); + limp = NULL; + } suspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev); } + if (limp) + queue_limits_commit_update(q, limp); + if (kn) sysfs_unbreak_active_protection(kn); @@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev) } EXPORT_SYMBOL_GPL(mddev_stack_new_rdev); +/ + * Stack a new rdev into limits the caller already holds limits_lock for and + * will commit itself. Used from paths that must take limits_lock before + * quiescing the array, see md_start_sync(). + / +int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) +{ + struct queue_limits tmp = lim; + + if (mddev_is_dm(mddev)) + return 0; + + if (queue_logical_block_size(rdev->bdev->bd_disk->queue) > + queue_logical_block_size(mddev->gendisk->queue)) { + pr_err("%s: incompatible logical_block_size, can not add\n", + mdname(mddev)); + return -EINVAL; + } + + queue_limits_stack_bdev(&tmp, rdev->bdev, rdev->data_offset, + mddev->gendisk->disk_name); + + if (!queue_limits_stack_integrity_bdev(&tmp, rdev->bdev)) { + pr_err("%s: incompatible integrity profile for %pg\n", + mdname(mddev), rdev->bdev); + return -ENXIO; + } + + lim = tmp; + return 0; +} +EXPORT_SYMBOL_GPL(mddev_stack_rdev_into); + +/* for callers that must not wait for q->limits_lock, see md_start_sync() / +static bool mddev_stack_limits_trylock(struct mddev mddev, + struct queue_limits lim) +{ + struct request_queue q; + + if (mddev_is_dm(mddev)) + return false; + + q = mddev->gendisk->queue; + + return queue_limits_start_update_trylock(q, lim); +} + /* update the optimal I/O size after a reshape / -void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes) +void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes, + struct queue_limits lim) { - struct queue_limits lim; + struct queue_limits own; if (mddev_is_dm(mddev)) return; + /* + * With an update owned by the caller just change it in place; it is + * committed, and the array resumed, by whoever started it. Taking + * q->limits_lock here would nest it inside reconfig_mutex and the + * suspend, which deadlocks, see md_start_sync(). + / + if (lim) { + lim->io_opt = lim->io_min nr_stripes; + return; + } + + /* + * Called from the sync thread, which md_reap_sync_thread() waits for + * with reconfig_mutex held, so don't wait for q->limits_lock here. + * io_opt is a hint, skipping it on a contended pass is fine. + / + if (!mddev_stack_limits_trylock(mddev, &own)) + return; + / don't bother updating io_opt if we can't suspend the array / - if (mddev_suspend(mddev, false) < 0) + if (mddev_suspend(mddev, false) < 0) { + queue_limits_cancel_update(mddev->gendisk->queue); return; - lim = queue_limits_start_update(mddev->gendisk->queue); - lim.io_opt = lim.io_min nr_stripes; - queue_limits_commit_update(mddev->gendisk->queue, &lim); + } + own.io_opt = own.io_min * nr_stripes; + queue_limits_commit_update(mddev->gendisk->queue, &own); mddev_resume(mddev); } EXPORT_SYMBOL_GPL(mddev_update_io_opt); @@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev mddev, void __user arg) return 0; } -int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) +int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info, + struct queue_limits lim) { struct md_rdev rdev; dev_t dev = MKDEV(info->major,info->minor); @@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) if (err) mddev->cluster_ops->add_new_disk_cancel(mddev); else - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); } } else if (!err) - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); return err; } @@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) return 0; } -static int hot_remove_disk(struct mddev mddev, dev_t dev) +static int hot_remove_disk(struct mddev mddev, dev_t dev, + struct queue_limits lim) { struct md_rdev rdev; @@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev mddev, dev_t dev) goto kick_rdev; clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(mddev, rdev); + remove_and_add_spares(mddev, rdev, lim); if (rdev->raid_disk >= 0) goto busy; @@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd) } } +/ + * Commands that can reach ->hot_add_disk(). ADD_NEW_DISK only does so for a + * journal device or a personality without ->hot_remove_disk, but that depends + * on disk info still in user memory here, so it is included as a whole. + / +static bool md_ioctl_may_add_disk(unsigned int cmd) +{ + switch (cmd) { + case ADD_NEW_DISK: + case HOT_REMOVE_DISK: + return true; + default: + return false; + } +} + static bool md_ioctl_need_suspend(unsigned int cmd) { switch (cmd) { @@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, unsigned int noio_flags = 0; void __user argp = (void __user )arg; struct mddev mddev = NULL; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; bool suspend; err = md_ioctl_valid(cmd); @@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, if (!md_is_rdwr(mddev)) flush_work(&mddev->sync_work); + /* q->limits_lock nests outside both, see md_start_sync() / + if (md_ioctl_may_add_disk(cmd) && !mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + suspend = md_ioctl_need_suspend(cmd); err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev); if (err) { pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n", err, cmd); + if (limp) + queue_limits_cancel_update(q); goto out; } if (suspend) @@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, goto unlock; case HOT_REMOVE_DISK: - err = hot_remove_disk(mddev, new_decode_dev(arg)); + err = hot_remove_disk(mddev, new_decode_dev(arg), limp); goto unlock; case ADD_NEW_DISK: @@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, / Need to clear read-only for this / break; else - err = md_add_new_disk(mddev, &info); + err = md_add_new_disk(mddev, &info, limp); goto unlock; } break; @@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, if (copy_from_user(&info, argp, sizeof(info))) err = -EFAULT; else - err = md_add_new_disk(mddev, &info); + err = md_add_new_disk(mddev, &info, limp); goto unlock; } @@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, err != -EINVAL) mddev->hold_active = 0; + if (limp) + queue_limits_commit_update(q, limp); + if (suspend) { memalloc_noio_restore(noio_flags); mddev_unlock_and_resume(mddev); @@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev mddev, struct md_rdev this) return removed; } -static int remove_and_add_spares(struct mddev mddev, - struct md_rdev this) +static int remove_and_add_spares(struct mddev mddev, struct md_rdev this, + struct queue_limits lim) { struct md_rdev rdev; int spares = 0; @@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev mddev, continue; if (!test_bit(Journal, &rdev->flags)) rdev->recovery_offset = 0; - if (mddev->pers->hot_add_disk(mddev, rdev) == 0) { + if (mddev->pers->hot_add_disk(mddev, rdev, lim) == 0) { /* failure here is OK / sysfs_link_rdev(mddev, rdev); if (!test_bit(Journal, &rdev->flags)) @@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev mddev, return spares; } -static bool md_choose_sync_action(struct mddev mddev, int spares) +static bool md_choose_sync_action(struct mddev mddev, int spares, + struct queue_limits lim) { / Check if reshape is in progress first. / if (mddev->reshape_position != MaxSector) { @@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev mddev, int spares) also removed and re-added, to allow the personality to fail the * re-add. / - spares = remove_and_add_spares(mddev, NULL); + spares = remove_and_add_spares(mddev, NULL, lim); if (spares \|\| test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery)) { clear_bit(MD_RECOVERY_SYNC, &mddev->recovery); clear_bit(MD_RECOVERY_CHECK, &mddev->recovery); @@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev mddev, int spares) static void md_start_sync(struct work_struct ws) { struct mddev mddev = container_of(ws, struct mddev, sync_work); + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; int spares = 0; bool suspend = false; unsigned int noio_flags = 0; @@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct ws) / if ((mddev->reshape_position == MaxSector \|\| !md_is_rdwr(mddev)) && md_spares_need_change(mddev)) { + /* + * Adding a spare below stacks its limits, which needs + * q->limits_lock. Take it before suspending: its holder + * waits in blk_mq_freeze_queue() for I/O that + * mddev->suspended holds back, so the other order deadlocks. + / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } suspend = true; mddev_suspend(mddev, false); noio_flags = memalloc_noio_save(); @@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct ws) if (!suspend && (mddev->reshape_position == MaxSector \|\| !md_is_rdwr(mddev)) && md_spares_need_change(mddev)) { mddev_unlock(mddev); + /* see above: q->limits_lock nests outside both / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } mddev_suspend_and_lock_nointr(mddev); suspend = true; noio_flags = memalloc_noio_save(); @@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct ws) * As we only add devices that are already in-sync, we can * activate the spares immediately. / - remove_and_add_spares(mddev, NULL); + remove_and_add_spares(mddev, NULL, limp); goto not_running; } - if (!md_choose_sync_action(mddev, &spares)) + if (!md_choose_sync_action(mddev, &spares, limp)) goto not_running; if (!mddev->pers->sync_request) @@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct ws) * https://bugzilla.kernel.org/show_bug.cgi?id=218200 * Therefore, use __mddev_resume(mddev, false). / + if (limp) + queue_limits_commit_update(q, limp); if (suspend) { memalloc_noio_restore(noio_flags); __mddev_resume(mddev, false); @@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct ws) * https://bugzilla.kernel.org/show_bug.cgi?id=218200 * Therefore, use __mddev_resume(mddev, false). / + if (limp) + queue_limits_commit_update(q, limp); if (suspend) { memalloc_noio_restore(noio_flags); __mddev_resume(mddev, false); @@ -10793,6 +10965,7 @@ static int __init md_init(void) static void check_sb_changes(struct mddev mddev, struct md_rdev rdev) { + struct queue_limits lim; struct mdp_superblock_1 sb = page_address(rdev->sb_page); struct md_rdev rdev2, tmp; int role, ret; @@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev mddev, struct md_rdev rdev) rdev2->saved_raid_disk = -1; else rdev2->saved_raid_disk = role; - ret = remove_and_add_spares(mddev, rdev2); + /* + * reconfig_mutex is held, so don't wait for + * q->limits_lock; MD_RECOVERY_NEEDED below + * leaves a skipped add to md_start_sync(). + / + if (mddev_stack_limits_trylock(mddev, &lim)) { + struct request_queue q = + mddev->gendisk->queue; + + ret = remove_and_add_spares(mddev, + rdev2, &lim); + queue_limits_commit_update(q, &lim); + } else if (mddev_is_dm(mddev)) { + ret = remove_and_add_spares(mddev, + rdev2, NULL); + } else { + ret = remove_spares(mddev, rdev2); + } pr_info("Activated spare: %pg\n", rdev2->bdev); /* wakeup mddev->thread here, so array could diff --git a/drivers/md/md.h b/drivers/md/md.h index b6d2e8929a0f9..ceca8cfcdcb9e 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -765,7 +765,8 @@ struct md_personality * if appropriate, and should abort recovery if needed / void (error_handler)(struct mddev mddev, struct md_rdev rdev); - int (hot_add_disk) (struct mddev mddev, struct md_rdev rdev); + int (hot_add_disk)(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim); int (hot_remove_disk) (struct mddev mddev, struct md_rdev rdev); int (spare_active) (struct mddev mddev); sector_t (sync_request)(struct mddev mddev, sector_t sector_nr, @@ -1041,13 +1042,17 @@ struct mdu_disk_info_s; extern int mdp_major; void md_autostart_arrays(int part); int md_set_array_info(struct mddev mddev, struct mdu_array_info_s info); -int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info); +int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info, + struct queue_limits lim); int do_md_run(struct mddev mddev); #define MDDEV_STACK_INTEGRITY (1u << 0) int mddev_stack_rdev_limits(struct mddev mddev, struct queue_limits lim, unsigned int flags); int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev); -void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes); +int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim); +void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes, + struct queue_limits lim); extern const struct block_device_operations md_fops; diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index f0646fb24371f..dd348b5695d06 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf conf, int disk) return true; } -static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r1conf conf = mddev->private; int err = -EEXIST; @@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev) for (mirror = first; mirror <= last; mirror++) { p = conf->mirrors + mirror; if (!p->rdev) { - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 1093c798d9dde..641619328a6c4 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev mddev) return count; } -static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r10conf conf = mddev->private; int err = -EEXIST; @@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) continue; } - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; p->head_position = 0; @@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) clear_bit(In_sync, &rdev->flags); set_bit(Replacement, &rdev->flags); rdev->raid_disk = repl_slot; - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; conf->fullsync = 1; @@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev mddev) rdev_for_each(rdev, mddev) if (rdev->raid_disk < 0 && !test_bit(Faulty, &rdev->flags)) { - if (raid10_add_disk(mddev, rdev) == 0) { + if (raid10_add_disk(mddev, rdev, NULL) == 0) { if (rdev->raid_disk >= conf->prev.raid_disks) set_bit(In_sync, &rdev->flags); @@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf conf) conf->reshape_safe = MaxSector; spin_unlock_irq(&conf->device_lock); - mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf)); + mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf), NULL); conf->fullsync = 0; } diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index b91545ce090de..22759c631c4d9 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7288,6 +7288,9 @@ static ssize_t raid5_store_skip_copy(struct mddev mddev, const char page, size_t len) { struct r5conf conf; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; unsigned long new; int err; @@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev mddev, const char page, size_t len) return -EINVAL; new = !!new; + / q->limits_lock nests outside both, see md_start_sync() / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + err = mddev_suspend_and_lock(mddev); - if (err) + if (err) { + if (limp) + queue_limits_cancel_update(q); return err; + } conf = mddev->private; if (!conf) err = -ENODEV; else if (new != conf->skip_copy) { - struct request_queue q = mddev->gendisk->queue; - struct queue_limits lim = queue_limits_start_update(q); - conf->skip_copy = new; - if (new) - lim.features \|= BLK_FEAT_STABLE_WRITES; - else - lim.features &= ~BLK_FEAT_STABLE_WRITES; - err = queue_limits_commit_update(q, &lim); + if (limp) { + if (new) + limp->features \|= BLK_FEAT_STABLE_WRITES; + else + limp->features &= ~BLK_FEAT_STABLE_WRITES; + } } + if (limp) + err = queue_limits_commit_update(q, limp) ?: err; mddev_unlock_and_resume(mddev); return err ?: len; } @@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev mddev, struct md_rdev rdev) return err; } -static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r5conf conf = mddev->private; int ret, err = -EEXIST; @@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev mddev) rdev_for_each(rdev, mddev) if (rdev->raid_disk < 0 && !test_bit(Faulty, &rdev->flags)) { - if (raid5_add_disk(mddev, rdev) == 0) { + if (raid5_add_disk(mddev, rdev, NULL) == 0) { if (rdev->raid_disk >= conf->previous_raid_disks) set_bit(In_sync, &rdev->flags); @@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf conf) wake_up(&conf->wait_for_reshape); mddev_update_io_opt(conf->mddev, - conf->raid_disks - conf->max_degraded); + conf->raid_disks - conf->max_degraded, NULL); } } diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 4f7905c3412b8..b75e85291e290 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue q) mutex_lock(&q->limits_lock); return q->limits; } + +/* + * queue_limits_start_update_trylock - try to start an atomic update of queue + * limits + * @q: queue to update + * @lim: returns a snapshot of the current limits on success + * + * Like queue_limits_start_update(), but fails instead of waiting when another + * update is in flight. For callers that must not block on q->limits_lock + * because they hold something its current owner is waiting for. + * + * Context: process context. + / +static inline bool +queue_limits_start_update_trylock(struct request_queue q, + struct queue_limits lim) + __cond_acquires(true, &q->limits_lock) +{ + if (!mutex_trylock(&q->limits_lock)) + return false; + + lim = q->limits; + + return true; +} + int queue_limits_commit_update_frozen(struct request_queue q, struct queue_limits lim) __releases(&q->limits_lock); int queue_limits_commit_update(struct request_queue *q,
3/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 15365 output: 31 thoughts: 725 Thoughts: Analyzing the MD RAID Patch for Fuzzing Potential Okay, let's break down this patch. My immediate thought is to determine if it's fuzz-worthy, what kind of configuration is needed, and if we can identify specific symbols to focus our fuzzing efforts on. First, I need to understand what this patch actually does. It looks like it's all about resolving lock ordering issues and potential deadlocks within the MD (Multiple Devices/software RAID) subsystem, specifically around those locks: `q->limits_lock`, `reconfig_mutex`, and `mddev_suspend()`. The code touches a lot of files within `drivers/md/`, so it's a pretty central area. It looks like the patch is adding this new `queue_limits_start_update_trylock` function. The patch then seems to be propagating changes throughout the MD subsystem, modifying function signatures and updating lock acquisition strategies. Specifically: * It updates calls related to adding disks (`hot_add_disk`, `md_add_new_disk`) and adjusting queue limits in the `dm-raid.c`, `md-autodetect.c`, and `md-linear.c` files. * The `md.c` file sees the most changes, including a new `queue_limits` parameter being added to the rdev sysfs entry `store` method. This also involves changes to how locks are acquired in `rdev_attr_store()`, adding new functions like `mddev_stack_rdev_into()` and `mddev_stack_limits_trylock()`, and updates to `mddev_update_io_opt()` and other core MD functions (`md_add_new_disk()`, `hot_remove_disk()`, `remove_and_add_spares()`, etc.). * It's also updating functions across several RAID implementations (`raid1.c`, `raid10.c`, `raid5.c`) to handle this `queue_limits` struct. Alright, that's the code. Now I need to consider reachability. MD RAID, being a core part of storage management, should be pretty easily reachable, especially in a fuzzing context. From what I know, it's accessible through ioctls on `/dev/md`, and sysfs entries under `/sys/block/mdX/md/...`. Syzkaller should already have good coverage for these interfaces. If so, that greatly increases the likelihood of finding bugs. Lastly, I need to check the Kconfig requirements. I'll need to confirm that MD RAID and its sub-components are enabled to trigger these updated code paths. Time to grep for the relevant `CONFIG_MD` and `CONFIG_BLK_DEV_MD*` options in the Kconfig files. This will tell me which configurations I need to set for a good fuzzing run.
4/2	2026/09/07 18:13	tool	grepper	0m Args: { "Expression": "config BLK_DEV_MD", "PathPrefix": "drivers/md/" } Results: { "Output": "drivers/md/Kconfig=13=if MD\ndrivers/md/Kconfig-14-\ndrivers/md/Kconfig:15:config BLK_DEV_MD\ndrivers/md/Kconfig-16-\ttristate \"RAID support\"\n" }
5/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 16813 output: 32 thoughts: 27 Thoughts: Here's my take on those thoughts: Investigating the MD Configuration Landscape Okay, so I need to get a handle on the MD (Multiple Device) configuration options within this kernel build. My initial thought is to zero in on `drivers/md/Kconfig`. That's where all the relevant Kconfig options and their dependencies are defined, naturally. I figure the first 50 lines or so should give me a good overview of the core MD settings. I'm hoping to quickly identify the key variables and any critical dependencies that might affect how MD is configured, and what the base-level choices are for RAID, LVM, and any other relevant block device management components. It's a quick way to get context and see how things are structured before digging deeper.
6/2	2026/09/07 18:13	tool	read-file	0m Args: { "File": "drivers/md/Kconfig", "FirstLine": 1, "LineCount": 70 } Results: { "Contents": " 1:\t# SPDX-License-Identifier: GPL-2.0-only\n 2:\t#\n 3:\t# Block device driver configuration\n 4:\t#\n 5:\t\n 6:\tmenuconfig MD\n 7:\t\tbool \"Multiple devices driver support (RAID and LVM)\"\n 8:\t\tdepends on BLOCK\n 9:\t\thelp\n 10:\t\t Support multiple physical spindles through a single logical device.\n 11:\t\t Required for RAID and logical volume management.\n 12:\t\n 13:\tif MD\n 14:\t\n 15:\tconfig BLK_DEV_MD\n 16:\t\ttristate \"RAID support\"\n 17:\t\tselect BLOCK_HOLDER_DEPRECATED if SYSFS\n 18:\t\tselect BUFFER_HEAD\n 19:\t\t# BLOCK_LEGACY_AUTOLOAD requirement should be removed\n 20:\t\t# after relevant mdadm enhancements - to make \"names=yes\"\n 21:\t\t# the default - are widely available.\n 22:\t\tselect BLOCK_LEGACY_AUTOLOAD\n 23:\t\thelp\n 24:\t\t This driver lets you combine several hard disk partitions into one\n 25:\t\t logical block device. This can be used to simply append one\n 26:\t\t partition to another one or to combine several redundant hard disks\n 27:\t\t into a RAID1/4/5 device so as to provide protection against hard\n 28:\t\t disk failures. This is called \"Software RAID\" since the combining of\n 29:\t\t the partitions is done by the kernel. \"Hardware RAID\" means that the\n 30:\t\t combining is done by a dedicated controller; if you have such a\n 31:\t\t controller, you do not need to say Y here.\n 32:\t\n 33:\t\t More information about Software RAID on Linux is contained in the\n 34:\t\t Software RAID mini-HOWTO, available from\n 35:\t\t \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also learn\n 36:\t\t where to get the supporting user space utilities raidtools.\n 37:\t\n 38:\t\t If unsure, say N.\n 39:\t\n 40:\tconfig MD_BITMAP\n 41:\t\tbool \"MD RAID bitmap support\"\n 42:\t\tdefault y\n 43:\t\tdepends on BLK_DEV_MD\n 44:\t\thelp\n 45:\t\t If you say Y here, support for the write intent bitmap will be\n 46:\t\t enabled. The bitmap can be used to optimize resync speed after power\n 47:\t\t failure or readding a disk, limiting it to recorded dirty sectors in\n 48:\t\t bitmap.\n 49:\t\n 50:\t\t This feature can be added to existing MD array or MD array can be\n 51:\t\t created with bitmap via mdadm(8).\n 52:\t\n 53:\t\t If unsure, say Y.\n 54:\t\n 55:\tconfig MD_LLBITMAP\n 56:\t\tbool \"MD RAID lockless bitmap support\"\n 57:\t\tdepends on BLK_DEV_MD\n 58:\t\thelp\n 59:\t\t If you say Y here, support for the lockless write intent bitmap will\n 60:\t\t be enabled.\n 61:\t\n 62:\t\t Note, this is an experimental feature.\n 63:\t\n 64:\t\t If unsure, say N.\n 65:\t\n 66:\tconfig MD_AUTODETECT\n 67:\t\tbool \"Autodetect RAID arrays during kernel boot\"\n 68:\t\tdepends on BLK_DEV_MD=y\n 69:\t\tdefault y\n 70:\t\thelp\n" }
7/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 17966 output: 33 thoughts: 38 Thoughts: Okay, here's my take on those thoughts, tailored for an expert audience: Analyzing RAID Personality Configurations in `drivers/md/Kconfig` Alright, let's dive into the details. I need to make sure I haven't missed any edge cases or overlooked modifications. My primary focus is to examine the `drivers/md/Kconfig` file, specifically looking at the configurations related to RAID personalities that have been altered, specifically focusing on linear, raid1, raid10, and raid456/raid5. I need to ensure the modifications made are consistent across all affected RAID levels and that there are no unintended consequences in how these personalities are defined or enabled. I'll be meticulously checking dependencies, defaults, and any conditional logic to get a holistic view of the implications of the changes. This thorough analysis should help me identify and rectify any potential issues before they cause problems.
8/2	2026/09/07 18:13	tool	read-file	0m Args: { "File": "drivers/md/Kconfig", "FirstLine": 71, "LineCount": 80 } Results: { "Contents": " 71:\t\t If you say Y here, then the kernel will try to autodetect raid\n 72:\t\t arrays as part of its boot process.\n 73:\t\n 74:\t\t If you don't use raid and say Y, this autodetection can cause\n 75:\t\t a several-second delay in the boot time due to various\n 76:\t\t synchronisation steps that are part of this step.\n 77:\t\n 78:\t\t If unsure, say Y.\n 79:\t\n 80:\tconfig MD_BITMAP_FILE\n 81:\t\tbool \"MD bitmap file support (deprecated)\"\n 82:\t\tdefault y\n 83:\t\tdepends on MD_BITMAP\n 84:\t\thelp\n 85:\t\t If you say Y here, support for write intent bitmaps in files on an\n 86:\t\t external file system is enabled. This is an alternative to the internal\n 87:\t\t bitmaps near the MD superblock, and very problematic code that abuses\n 88:\t\t various kernel APIs and can only work with files on a file system not\n 89:\t\t actually sitting on the MD device.\n 90:\t\n 91:\tconfig MD_LINEAR\n 92:\t\ttristate \"Linear (append) mode\"\n 93:\t\tdepends on BLK_DEV_MD\n 94:\t\thelp\n 95:\t\t If you say Y here, then your multiple devices driver will be able to\n 96:\t\t use the so-called linear mode, i.e. it will combine the hard disk\n 97:\t\t partitions by simply appending one to the other.\n 98:\t\n 99:\t\t To compile this as a module, choose M here: the module\n 100:\t\t will be called linear.\n 101:\t\n 102:\t\t If unsure, say Y.\n 103:\t\n 104:\tconfig MD_RAID0\n 105:\t\ttristate \"RAID-0 (striping) mode\"\n 106:\t\tdepends on BLK_DEV_MD\n 107:\t\thelp\n 108:\t\t If you say Y here, then your multiple devices driver will be able to\n 109:\t\t use the so-called raid0 mode, i.e. it will combine the hard disk\n 110:\t\t partitions into one logical device in such a fashion as to fill them\n 111:\t\t up evenly, one chunk here and one chunk there. This will increase\n 112:\t\t the throughput rate if the partitions reside on distinct disks.\n 113:\t\n 114:\t\t Information about Software RAID on Linux is contained in the\n 115:\t\t Software-RAID mini-HOWTO, available from\n 116:\t\t \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also\n 117:\t\t learn where to get the supporting user space utilities raidtools.\n 118:\t\n 119:\t\t To compile this as a module, choose M here: the module\n 120:\t\t will be called raid0.\n 121:\t\n 122:\t\t If unsure, say Y.\n 123:\t\n 124:\tconfig MD_RAID1\n 125:\t\ttristate \"RAID-1 (mirroring) mode\"\n 126:\t\tdepends on BLK_DEV_MD\n 127:\t\thelp\n 128:\t\t A RAID-1 set consists of several disk drives which are exact copies\n 129:\t\t of each other. In the event of a mirror failure, the RAID driver\n 130:\t\t will continue to use the operational mirrors in the set, providing\n 131:\t\t an error free MD (multiple device) to the higher levels of the\n 132:\t\t kernel. In a set with N drives, the available space is the capacity\n 133:\t\t of a single drive, and the set protects against a failure of (N - 1)\n 134:\t\t drives.\n 135:\t\n 136:\t\t Information about Software RAID on Linux is contained in the\n 137:\t\t Software-RAID mini-HOWTO, available from\n 138:\t\t \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also\n 139:\t\t learn where to get the supporting user space utilities raidtools.\n 140:\t\n 141:\t\t If you want to use such a RAID-1 set, say Y. To compile this code\n 142:\t\t as a module, choose M here: the module will be called raid1.\n 143:\t\n 144:\t\t If unsure, say Y.\n 145:\t\n 146:\tconfig MD_RAID10\n 147:\t\ttristate \"RAID-10 (mirrored striping) mode\"\n 148:\t\tdepends on BLK_DEV_MD\n 149:\t\thelp\n 150:\t\t RAID-10 provides a combination of striping (RAID-0) and\n" }
9/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 19506 output: 34 thoughts: 15 Thoughts: Okay, here's the summary, rendered as if I'm the one thinking it: Considering RAID Options Alright, I've been focusing primarily on the more common RAID configurations, but it's crucial to be thorough. Let's not overlook some of the less-used but potentially relevant options. Time to expand my mental checklist. I need to make sure I haven't missed anything, especially in specific use cases where these alternatives might be ideal. My initial considerations covered the workhorses, but a deeper dive is necessary. Specifically, let's also give a thorough once-over to RAID 4, 5, and 6 – revisiting their strengths, weaknesses, and potential applicability. I should also refresh my understanding of DM-RAID's capabilities and its place in this landscape. A comprehensive view requires this more granular analysis.
10/2	2026/09/07 18:13	tool	read-file	0m Args: { "File": "drivers/md/Kconfig", "FirstLine": 151, "LineCount": 70 } Results: { "Contents": " 151:\t\t mirroring (RAID-1) with easier configuration and more flexible\n 152:\t\t layout.\n 153:\t\t Unlike RAID-0, but like RAID-1, RAID-10 requires all devices to\n 154:\t\t be the same size (or at least, only as much as the smallest device\n 155:\t\t will be used).\n 156:\t\t RAID-10 provides a variety of layouts that provide different levels\n 157:\t\t of redundancy and performance.\n 158:\t\n 159:\t\t RAID-10 requires mdadm-1.7.0 or later, available at:\n 160:\t\n 161:\t\t https://www.kernel.org/pub/linux/utils/raid/mdadm/\n 162:\t\n 163:\t\t If unsure, say Y.\n 164:\t\n 165:\tconfig MD_RAID456\n 166:\t\ttristate \"RAID-4/RAID-5/RAID-6 mode\"\n 167:\t\tdepends on BLK_DEV_MD\n 168:\t\tselect RAID6_PQ\n 169:\t\tselect CRC32\n 170:\t\tselect ASYNC_MEMCPY\n 171:\t\tselect ASYNC_XOR\n 172:\t\tselect ASYNC_PQ\n 173:\t\tselect ASYNC_RAID6_RECOV\n 174:\t\thelp\n 175:\t\t A RAID-5 set of N drives with a capacity of C MB per drive provides\n 176:\t\t the capacity of C * (N - 1) MB, and protects against a failure\n 177:\t\t of a single drive. For a given sector (row) number, (N - 1) drives\n 178:\t\t contain data sectors, and one drive contains the parity protection.\n 179:\t\t For a RAID-4 set, the parity blocks are present on a single drive,\n 180:\t\t while a RAID-5 set distributes the parity across the drives in one\n 181:\t\t of the available parity distribution methods.\n 182:\t\n 183:\t\t A RAID-6 set of N drives with a capacity of C MB per drive\n 184:\t\t provides the capacity of C * (N - 2) MB, and protects\n 185:\t\t against a failure of any two drives. For a given sector\n 186:\t\t (row) number, (N - 2) drives contain data sectors, and two\n 187:\t\t drives contains two independent redundancy syndromes. Like\n 188:\t\t RAID-5, RAID-6 distributes the syndromes across the drives\n 189:\t\t in one of the available parity distribution methods.\n 190:\t\n 191:\t\t Information about Software RAID on Linux is contained in the\n 192:\t\t Software-RAID mini-HOWTO, available from\n 193:\t\t \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also\n 194:\t\t learn where to get the supporting user space utilities raidtools.\n 195:\t\n 196:\t\t If you want to use such a RAID-4/RAID-5/RAID-6 set, say Y. To\n 197:\t\t compile this code as a module, choose M here: the module\n 198:\t\t will be called raid456.\n 199:\t\n 200:\t\t If unsure, say Y.\n 201:\t\n 202:\tconfig MD_CLUSTER\n 203:\t\ttristate \"Cluster Support for MD\"\n 204:\t\tselect MD_BITMAP\n 205:\t\tdepends on BLK_DEV_MD\n 206:\t\tdepends on DLM\n 207:\t\tdefault n\n 208:\t\thelp\n 209:\t\tClustering support for MD devices. This enables locking and\n 210:\t\tsynchronization across multiple systems on the cluster, so all\n 211:\t\tnodes in the cluster can access the MD devices simultaneously.\n 212:\t\n 213:\t\tThis brings the redundancy (and uptime) of RAID levels across the\n 214:\t\tnodes of the cluster. Currently, it can work with raid1 and raid10\n 215:\t\t(limited support).\n 216:\t\n 217:\t\tIf unsure, say N.\n 218:\t\n 219:\tsource \"drivers/md/bcache/Kconfig\"\n 220:\t\n" }
11/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 20891 output: 29 thoughts: 10 Thoughts: Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert and using first-person perspective: Checking DM-RAID in a Broader Context Right, so we're looking at this particular issue, and I've already considered [mention previous points if the original context is available]. Now, I need to expand my focus a bit. Let's make sure we haven't overlooked something related to DM-RAID. It's often the elephant in the room that gets forgotten when diagnosing complex storage issues. Things get hairy fast when you have LVM, MD and DM-RAID all playing together. I need to quickly recall the typical failure modes, gotchas, and interactions between the components in that stack. Specifically, are the kernel modules loaded? Is the device mapper layer behaving as expected, and how about the RAID configuration itself? I'll probably also need to consider some of the more advanced features like multipathing and snapshotting as potential complicating factors. I suspect DM-RAID here, but its worth a quick check to rule it out before I go deeper down a rabbit hole.
12/2	2026/09/07 18:13	tool	grepper	0m Args: { "Expression": "config DM_RAID", "PathPrefix": "drivers/md/" } Results: { "Output": "drivers/md/Kconfig=420=config DM_LOG_USERSPACE\n--\ndrivers/md/Kconfig-430-\ndrivers/md/Kconfig:431:config DM_RAID\ndrivers/md/Kconfig-432- tristate \"RAID 1/4/5/6/10 target\"\n" }
13/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 21265 output: 29 thoughts: 1065 Thoughts: Analysis of Potential Fuzzing Targets in the MD Layer Okay, let's break this down. First, the question of whether this patch is "WorthFuzzing" is a resounding "yes." The modifications touch critical areas of the MD (Multiple Device) layer: locking hierarchies involving mutexes and locks like `q->limits_lock` and `reconfig_mutex`, queue limits handling, and disk addition/removal, all across several RAID personalities. Specifically, changes in ioctl handling, sysfs interactions, sync thread execution, and `hot_add_disk` callbacks indicate a high likelihood of introducing race conditions, deadlocks, or other concurrency-related bugs. Given that these code paths are directly accessible from user space via ioctls and sysfs, fuzzing is absolutely crucial to test the robustness of the new locking order and queue limit implementations. Now, let's identify the specific "FocusSymbols" to target with the fuzzer. We need to select the key functions and entry points that encapsulate the changed logic. Here's my list, based on the modified and newly introduced functions: * In `drivers/md/md.c`: `mddev_stack_rdev_into`, `mddev_update_io_opt`, `md_add_new_disk`, `remove_and_add_spares`, `hot_remove_disk`, `rdev_attr_store`, `md_ioctl`, `md_start_sync`, `check_sb_changes`, `add_bound_rdev`. * In `drivers/md/raid1.c`: `raid1_add_disk` * In `drivers/md/raid10.c`: `raid10_add_disk` * In `drivers/md/raid5.c`: `raid5_add_disk`, `raid5_store_skip_copy` * In `drivers/md/md-linear.c`: `linear_add` I also confirmed that `queue_limits_start_update_trylock` is a static inline in `include/linux/blkdev.h`, as expected. Finally, we need to ensure the correct kernel configurations are enabled to trigger the fuzzing. The patch touches multiple RAID personalities and related functionality, so we need to enable the following configurations to ensure all relevant code paths are tested: * `BLK_DEV_MD` * `MD_RAID1` * `MD_RAID10` * `MD_RAID456` * `MD_LINEAR` * `DM_RAID` I am also double-checking the configuration coverage. The patch modifies files related to multiple RAID implementations, so enabling these configuration options should cover the modified code. In addition to the above, I'll need to remember that `DM_RAID` (which depends on `BLK_DEV_DM` and indirectly on `MD_RAID456`) is relevant because of the `drivers/md/dm-raid.c` change, and to a lesser extent, `MD_AUTODETECT` as well. With this configuration and focusing on the listed symbols, we can perform a comprehensive fuzzing campaign on this patch.
14/2	2026/09/07 18:13	tool	grepper	0m Args: { "Expression": "config DM_RAID", "PathPrefix": "drivers/md/" } Results: { "Output": "drivers/md/Kconfig=420=config DM_LOG_USERSPACE\n--\ndrivers/md/Kconfig-430-\ndrivers/md/Kconfig:431:config DM_RAID\ndrivers/md/Kconfig-432- tristate \"RAID 1/4/5/6/10 target\"\n" }
15/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23150 output: 34 thoughts: 19 Thoughts: Here's my summary, as though I'm thinking through this process: Diving into the Kernel Configuration for RAID Okay, so I need to track down something related to the RAID configuration. The context suggests that the relevant code will be in the kernel configuration files. Right, that makes sense. Let's start with `drivers/md/Kconfig`. This is where all the module configuration for the RAID drivers will be. It's a natural starting point. Specifically, let's zero in on line 431. I'm hoping to get a clue there to what is being configured and where things are defined. I have a hunch that whatever I'm looking for will be related to whatever is on that line.
16/2	2026/09/07 18:13	tool	read-file	0m Args: { "File": "drivers/md/Kconfig", "FirstLine": 425, "LineCount": 20 } Results: { "Contents": " 425:\t\t The userspace logging module provides a mechanism for\n 426:\t\t relaying the dm-dirty-log API to userspace. Log designs\n 427:\t\t which are more suited to userspace implementation (e.g.\n 428:\t\t shared storage logs) or experimental logs can be implemented\n 429:\t\t by leveraging this framework.\n 430:\t\n 431:\tconfig DM_RAID\n 432:\t tristate \"RAID 1/4/5/6/10 target\"\n 433:\t depends on BLK_DEV_DM\n 434:\t select MD_RAID0\n 435:\t select MD_RAID1\n 436:\t select MD_RAID10\n 437:\t select MD_RAID456\n 438:\t select MD_BITMAP\n 439:\t select BLK_DEV_MD\n 440:\t\thelp\n 441:\t\t A dm target that supports RAID1, RAID10, RAID4, RAID5 and RAID6 mappings\n 442:\t\n 443:\t\t A RAID-5 set of N drives with a capacity of C MB per drive provides\n 444:\t\t the capacity of C * (N - 1) MB, and protects against a failure\n" }
17/2	2026/09/07 18:13	llm	patch-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 23704 output: 285 thoughts: 385 Thoughts: My Analysis of the MD RAID Layer Refactoring Okay, so I've been looking at this patch and, based on the configs—`BLK_DEV_MD`, `MD_RAID1`, `MD_RAID10`, `MD_RAID456`, `MD_LINEAR`, and `DM_RAID`—it's clearly focused on the MD (software RAID) layer. The core of this refactor seems to be about how queue limits are updated and the order in which locks are acquired, specifically concerning the interaction between `q->limits_lock`, `reconfig_mutex`, and device suspension. They're introducing `queue_limits_start_update_trylock()` and `mddev_stack_rdev_into()`. Anytime you mess with lock hierarchies in this kind of low-level code, my antenna go up. We're talking about operations during hot-add, spare removal/addition, reshapes, and those are all sensitive points. It's also worth noting how many interactions the kernel has with those. We should be extra vigilant, and that means we will need to give it special attention to avoid subtle deadlocks, locking inconsistencies, and potential state regressions. Let's do a sanity check on the focus symbols. Looks like we've got a good list: `mddev_stack_rdev_into`, `mddev_update_io_opt`, `md_add_new_disk`, `remove_and_add_spares`, `rdev_attr_store`, `md_start_sync`, `raid1_add_disk`, `raid10_add_disk`, `raid5_add_disk`, `raid5_store_skip_copy`, and `linear_add`. This looks like a solid list. They are all specific to MD RAID, and that's exactly what we want. They are also present in the modified C files which means it is a good starting point for review. I need to flag this for fuzzing and extensive testing. Now, I'm going to call `set-results`.
18/2	2026/09/07 18:13	tool	set-results	0m Args: { "EnableConfigs": [ "BLK_DEV_MD", "MD_RAID1", "MD_RAID10", "MD_RAID456", "MD_LINEAR", "DM_RAID" ], "FocusSymbols": [ "mddev_stack_rdev_into", "mddev_update_io_opt", "md_add_new_disk", "remove_and_add_spares", "rdev_attr_store", "md_start_sync", "raid1_add_disk", "raid10_add_disk", "raid5_add_disk", "raid5_store_skip_copy", "linear_add" ], "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.", "WorthFuzzing": true } Results: { "EnableConfigs": [ "BLK_DEV_MD", "MD_RAID1", "MD_RAID10", "MD_RAID456", "MD_LINEAR", "DM_RAID" ], "FocusSymbols": [ "mddev_stack_rdev_into", "mddev_update_io_opt", "md_add_new_disk", "remove_and_add_spares", "rdev_attr_store", "md_start_sync", "raid1_add_disk", "raid10_add_disk", "raid5_add_disk", "raid5_store_skip_copy", "linear_add" ], "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.", "WorthFuzzing": true }
19/1	2026/09/07 18:13	action	If	0m Args: { "WorthFuzzing": true } Results: null
20/2	2026/09/07 18:13	agent	kmsan-evaluator	0m Model: core Args: null Results: { "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.", "NeedsKMSAN": false } Instruction:* You are an expert Linux kernel security engineer specializing in kernel memory error detectors (KASAN and KMSAN). Your job is to review the provided patch series and determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer) fuzzing session in addition to standard KASAN fuzzing. CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN: - Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable a comprehensive suite of debugging tools and sanitizers, including KASAN (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks. - KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap, or page allocations) and kernel-to-user memory info-leaks. Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN, LOCKDEP, OR OTHER STANDARD BUG DETECTORS. A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks that are detected ONLY by KMSAN. Look holistically at the patch series and surrounding code. Even if no direct uninitialized field accesses or new buffer allocations are added in the diff itself, a patch may alter control flow, bounds checking, or data length calculations in ways that change how the rest of the code operates on existing buffers (e.g. allowing uninitialized stack/heap memory to be read, copied to user space, or used in control flow). Do not hesitate to use your code access tools to inspect the surrounding code, called functions, and callers. Set NeedsKMSAN=true ONLY IF the patch introduces or modifies: 1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb attributes, ioctl output arguments, socket options, or BPF buffers) where fields or structure padding might not be fully initialized/zeroed. 2. Conditional logic or branching that depends on potentially uninitialized variables or struct fields. 3. Allocation or initialization of complex data structures where uninitialized fields could be read later in reachable code paths. 4. Bounds checks, lengths, or logic in a way that allows surrounding code to access uninitialized bytes of existing buffers. Set NeedsKMSAN=false IF: - The code changes primarily risk out-of-bounds access, array overflows, NULL pointer dereferences, locking deadlocks, or use-after-free bugs (these are already caught by KASAN, LOCKDEP, or standard bug detectors). - All stack/heap structures touched or introduced by the patch are fully zeroed or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied. - The patch does not introduce any risk of uninitialized memory usage or info-leaks. Use your code access tools to inspect the surrounding code if necessary, then provide detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch. Prefer calling several tools at the same time to save round-trips. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Target architecture: amd64 For your convenience, here is the diff of the changes: commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e Author: syz-cluster <triage@syzkaller.com> Date: Mon Sep 7 18:13:15 2026 +0000 syz-cluster: applied patch under review diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c index 8f5a5e1342a95..21a1922bee4fb 100644 --- a/drivers/md/dm-raid.c +++ b/drivers/md/dm-raid.c @@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set rs) clear_bit(Faulty, &r->flags); clear_bit(WriteErrorSeen, &r->flags); - if (mddev->pers->hot_add_disk(mddev, r)) { + if (mddev->pers->hot_add_disk(mddev, r, NULL)) { / Failed to revive this device, try next / r->raid_disk = r->saved_raid_disk = -1; r->flags = flags; diff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c index 4b80165afd233..929513109657f 100644 --- a/drivers/md/md-autodetect.c +++ b/drivers/md/md-autodetect.c @@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args args) (1 << MD_DISK_ACTIVE) \| (1 << MD_DISK_SYNC); } - md_add_new_disk(mddev, &dinfo); + md_add_new_disk(mddev, &dinfo, NULL); } if (!err) diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c index 73b367b61b873..1f44c2d7db93d 100644 --- a/drivers/md/md-linear.c +++ b/drivers/md/md-linear.c @@ -186,7 +186,8 @@ static int linear_run(struct mddev mddev) return ret; } -static int linear_add(struct mddev mddev, struct md_rdev rdev) +static int linear_add(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { /* Adding a drive to a linear array allows the array to grow. * It is permitted if the new drive has a matching superblock diff --git a/drivers/md/md.c b/drivers/md/md.c index 680b34a63cb3d..c4054d06d1070 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait); / static struct workqueue_struct md_misc_wq; -static int remove_and_add_spares(struct mddev mddev, - struct md_rdev this); +static int remove_and_add_spares(struct mddev mddev, struct md_rdev this, + struct queue_limits lim); static void mddev_detach(struct mddev mddev); static void export_rdev(struct md_rdev rdev); static void md_wakeup_thread_directly(struct md_thread __rcu thread); @@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev mddev, int force_change) } EXPORT_SYMBOL(md_update_sb); -static int add_bound_rdev(struct md_rdev rdev) +static int add_bound_rdev(struct md_rdev rdev, struct queue_limits lim) { struct mddev mddev = rdev->mddev; int err = 0; @@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev rdev) / super_types[mddev->major_version]. validate_super(mddev, NULL/freshest/, rdev); - err = mddev->pers->hot_add_disk(mddev, rdev); + err = mddev->pers->hot_add_disk(mddev, rdev, lim); if (err) { md_kick_rdev_from_array(rdev); return err; @@ -3033,7 +3033,13 @@ static int cmd_match(const char cmd, const char str) struct rdev_sysfs_entry { struct attribute attr; ssize_t (show)(struct md_rdev , char ); - ssize_t (store)(struct md_rdev , const char , size_t); + /* + * @lim: a queue limits update the caller owns, or NULL. Stores that + * can add a leg to the array must stack into it rather than take + * q->limits_lock themselves, see md_start_sync(). + / + ssize_t (store)(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim); }; static ssize_t @@ -3079,7 +3085,8 @@ state_show(struct md_rdev rdev, char page) } static ssize_t -state_store(struct md_rdev rdev, const char buf, size_t len) +state_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { /* can write * faulty - simulates an error @@ -3110,7 +3117,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len) } else if (cmd_match(buf, "remove")) { if (rdev->mddev->pers) { clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(rdev->mddev, rdev); + remove_and_add_spares(rdev->mddev, rdev, lim); } if (rdev->raid_disk >= 0) err = -EBUSY; @@ -3229,7 +3236,7 @@ state_store(struct md_rdev rdev, const char buf, size_t len) if (!mddev_is_clustered(rdev->mddev) \|\| (err = mddev->cluster_ops->gather_bitmaps(rdev)) == 0) { clear_bit(Faulty, &rdev->flags); - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); } } else err = -EBUSY; @@ -3257,7 +3264,8 @@ errors_show(struct md_rdev rdev, char page) } static ssize_t -errors_store(struct md_rdev rdev, const char buf, size_t len) +errors_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned int n; int rv; @@ -3283,7 +3291,8 @@ slot_show(struct md_rdev rdev, char page) } static ssize_t -slot_store(struct md_rdev rdev, const char buf, size_t len) +slot_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { int slot; int err; @@ -3314,7 +3323,7 @@ slot_store(struct md_rdev rdev, const char buf, size_t len) if (rdev->mddev->pers->hot_remove_disk == NULL) return -EINVAL; clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(rdev->mddev, rdev); + remove_and_add_spares(rdev->mddev, rdev, lim); if (rdev->raid_disk >= 0) return -EBUSY; set_bit(MD_RECOVERY_NEEDED, &rdev->mddev->recovery); @@ -3344,7 +3353,8 @@ slot_store(struct md_rdev rdev, const char buf, size_t len) rdev->saved_raid_disk = -1; clear_bit(In_sync, &rdev->flags); clear_bit(Bitmap_sync, &rdev->flags); - err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev); + err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev, + lim); if (err) { rdev->raid_disk = -1; return err; @@ -3377,7 +3387,8 @@ offset_show(struct md_rdev rdev, char page) } static ssize_t -offset_store(struct md_rdev rdev, const char buf, size_t len) +offset_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long offset; if (kstrtoull(buf, 10, &offset) < 0) @@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev rdev, char page) } static ssize_t new_offset_store(struct md_rdev rdev, - const char buf, size_t len) + const char buf, size_t len, + struct queue_limits lim) { unsigned long long new_offset; struct mddev mddev = rdev->mddev; @@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char buf, sector_t sectors) } static ssize_t -rdev_size_store(struct md_rdev rdev, const char buf, size_t len) +rdev_size_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { struct mddev my_mddev = rdev->mddev; sector_t oldsectors = rdev->sectors; @@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev rdev, char page) return sprintf(page, "%llu\n", recovery_start); } -static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len) +static ssize_t recovery_start_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long recovery_start; @@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev rdev, char page) { return badblocks_show(&rdev->badblocks, page, 0); } -static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len) + +static ssize_t bb_store(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim) { int rv = badblocks_store(&rdev->badblocks, page, len, 0); /* Maybe that ack was all we needed / @@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev rdev, char page) { return badblocks_show(&rdev->badblocks, page, 1); } -static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len) + +static ssize_t ubb_store(struct md_rdev rdev, const char page, size_t len, + struct queue_limits lim) { return badblocks_store(&rdev->badblocks, page, len, 1); } @@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev rdev, char page) } static ssize_t -ppl_sector_store(struct md_rdev rdev, const char buf, size_t len) +ppl_sector_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned long long sector; @@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev rdev, char page) } static ssize_t -ppl_size_store(struct md_rdev rdev, const char buf, size_t len) +ppl_size_store(struct md_rdev rdev, const char buf, size_t len, + struct queue_limits lim) { unsigned int size; @@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject kobj, struct attribute attr, struct rdev_sysfs_entry entry = container_of(attr, struct rdev_sysfs_entry, attr); struct md_rdev rdev = container_of(kobj, struct md_rdev, kobj); struct kernfs_node kn = NULL; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; bool suspend = false; ssize_t rv; struct mddev mddev = READ_ONCE(rdev->mddev); @@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject kobj, struct attribute attr, suspend = true; } + /* + * These can add a leg back, which stacks its limits; the other + * state_store() values never reach ->hot_add_disk(). q->limits_lock + * nests outside the lock and the suspend, see md_start_sync(). + / + if ((entry->store == slot_store \|\| + (entry->store == state_store && + (cmd_match(page, "remove") \|\| cmd_match(page, "re-add")))) && + !mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + rv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev); if (!rv) { if (rdev->mddev == NULL) rv = -ENODEV; else - rv = entry->store(rdev, page, length); + rv = entry->store(rdev, page, length, limp); + / apply the limits before the array takes I/O again / + if (limp) { + queue_limits_commit_update(q, limp); + limp = NULL; + } suspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev); } + if (limp) + queue_limits_commit_update(q, limp); + if (kn) sysfs_unbreak_active_protection(kn); @@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev) } EXPORT_SYMBOL_GPL(mddev_stack_new_rdev); +/ + * Stack a new rdev into limits the caller already holds limits_lock for and + * will commit itself. Used from paths that must take limits_lock before + * quiescing the array, see md_start_sync(). + / +int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) +{ + struct queue_limits tmp = lim; + + if (mddev_is_dm(mddev)) + return 0; + + if (queue_logical_block_size(rdev->bdev->bd_disk->queue) > + queue_logical_block_size(mddev->gendisk->queue)) { + pr_err("%s: incompatible logical_block_size, can not add\n", + mdname(mddev)); + return -EINVAL; + } + + queue_limits_stack_bdev(&tmp, rdev->bdev, rdev->data_offset, + mddev->gendisk->disk_name); + + if (!queue_limits_stack_integrity_bdev(&tmp, rdev->bdev)) { + pr_err("%s: incompatible integrity profile for %pg\n", + mdname(mddev), rdev->bdev); + return -ENXIO; + } + + lim = tmp; + return 0; +} +EXPORT_SYMBOL_GPL(mddev_stack_rdev_into); + +/* for callers that must not wait for q->limits_lock, see md_start_sync() / +static bool mddev_stack_limits_trylock(struct mddev mddev, + struct queue_limits lim) +{ + struct request_queue q; + + if (mddev_is_dm(mddev)) + return false; + + q = mddev->gendisk->queue; + + return queue_limits_start_update_trylock(q, lim); +} + /* update the optimal I/O size after a reshape / -void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes) +void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes, + struct queue_limits lim) { - struct queue_limits lim; + struct queue_limits own; if (mddev_is_dm(mddev)) return; + /* + * With an update owned by the caller just change it in place; it is + * committed, and the array resumed, by whoever started it. Taking + * q->limits_lock here would nest it inside reconfig_mutex and the + * suspend, which deadlocks, see md_start_sync(). + / + if (lim) { + lim->io_opt = lim->io_min nr_stripes; + return; + } + + /* + * Called from the sync thread, which md_reap_sync_thread() waits for + * with reconfig_mutex held, so don't wait for q->limits_lock here. + * io_opt is a hint, skipping it on a contended pass is fine. + / + if (!mddev_stack_limits_trylock(mddev, &own)) + return; + / don't bother updating io_opt if we can't suspend the array / - if (mddev_suspend(mddev, false) < 0) + if (mddev_suspend(mddev, false) < 0) { + queue_limits_cancel_update(mddev->gendisk->queue); return; - lim = queue_limits_start_update(mddev->gendisk->queue); - lim.io_opt = lim.io_min nr_stripes; - queue_limits_commit_update(mddev->gendisk->queue, &lim); + } + own.io_opt = own.io_min * nr_stripes; + queue_limits_commit_update(mddev->gendisk->queue, &own); mddev_resume(mddev); } EXPORT_SYMBOL_GPL(mddev_update_io_opt); @@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev mddev, void __user arg) return 0; } -int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) +int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info, + struct queue_limits lim) { struct md_rdev rdev; dev_t dev = MKDEV(info->major,info->minor); @@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) if (err) mddev->cluster_ops->add_new_disk_cancel(mddev); else - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); } } else if (!err) - err = add_bound_rdev(rdev); + err = add_bound_rdev(rdev, lim); return err; } @@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info) return 0; } -static int hot_remove_disk(struct mddev mddev, dev_t dev) +static int hot_remove_disk(struct mddev mddev, dev_t dev, + struct queue_limits lim) { struct md_rdev rdev; @@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev mddev, dev_t dev) goto kick_rdev; clear_bit(Blocked, &rdev->flags); - remove_and_add_spares(mddev, rdev); + remove_and_add_spares(mddev, rdev, lim); if (rdev->raid_disk >= 0) goto busy; @@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd) } } +/ + * Commands that can reach ->hot_add_disk(). ADD_NEW_DISK only does so for a + * journal device or a personality without ->hot_remove_disk, but that depends + * on disk info still in user memory here, so it is included as a whole. + / +static bool md_ioctl_may_add_disk(unsigned int cmd) +{ + switch (cmd) { + case ADD_NEW_DISK: + case HOT_REMOVE_DISK: + return true; + default: + return false; + } +} + static bool md_ioctl_need_suspend(unsigned int cmd) { switch (cmd) { @@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, unsigned int noio_flags = 0; void __user argp = (void __user )arg; struct mddev mddev = NULL; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; bool suspend; err = md_ioctl_valid(cmd); @@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, if (!md_is_rdwr(mddev)) flush_work(&mddev->sync_work); + /* q->limits_lock nests outside both, see md_start_sync() / + if (md_ioctl_may_add_disk(cmd) && !mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + suspend = md_ioctl_need_suspend(cmd); err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev); if (err) { pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n", err, cmd); + if (limp) + queue_limits_cancel_update(q); goto out; } if (suspend) @@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, goto unlock; case HOT_REMOVE_DISK: - err = hot_remove_disk(mddev, new_decode_dev(arg)); + err = hot_remove_disk(mddev, new_decode_dev(arg), limp); goto unlock; case ADD_NEW_DISK: @@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, / Need to clear read-only for this / break; else - err = md_add_new_disk(mddev, &info); + err = md_add_new_disk(mddev, &info, limp); goto unlock; } break; @@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, if (copy_from_user(&info, argp, sizeof(info))) err = -EFAULT; else - err = md_add_new_disk(mddev, &info); + err = md_add_new_disk(mddev, &info, limp); goto unlock; } @@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device bdev, blk_mode_t mode, err != -EINVAL) mddev->hold_active = 0; + if (limp) + queue_limits_commit_update(q, limp); + if (suspend) { memalloc_noio_restore(noio_flags); mddev_unlock_and_resume(mddev); @@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev mddev, struct md_rdev this) return removed; } -static int remove_and_add_spares(struct mddev mddev, - struct md_rdev this) +static int remove_and_add_spares(struct mddev mddev, struct md_rdev this, + struct queue_limits lim) { struct md_rdev rdev; int spares = 0; @@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev mddev, continue; if (!test_bit(Journal, &rdev->flags)) rdev->recovery_offset = 0; - if (mddev->pers->hot_add_disk(mddev, rdev) == 0) { + if (mddev->pers->hot_add_disk(mddev, rdev, lim) == 0) { /* failure here is OK / sysfs_link_rdev(mddev, rdev); if (!test_bit(Journal, &rdev->flags)) @@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev mddev, return spares; } -static bool md_choose_sync_action(struct mddev mddev, int spares) +static bool md_choose_sync_action(struct mddev mddev, int spares, + struct queue_limits lim) { / Check if reshape is in progress first. / if (mddev->reshape_position != MaxSector) { @@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev mddev, int spares) also removed and re-added, to allow the personality to fail the * re-add. / - spares = remove_and_add_spares(mddev, NULL); + spares = remove_and_add_spares(mddev, NULL, lim); if (spares \|\| test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery)) { clear_bit(MD_RECOVERY_SYNC, &mddev->recovery); clear_bit(MD_RECOVERY_CHECK, &mddev->recovery); @@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev mddev, int spares) static void md_start_sync(struct work_struct ws) { struct mddev mddev = container_of(ws, struct mddev, sync_work); + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; int spares = 0; bool suspend = false; unsigned int noio_flags = 0; @@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct ws) / if ((mddev->reshape_position == MaxSector \|\| !md_is_rdwr(mddev)) && md_spares_need_change(mddev)) { + /* + * Adding a spare below stacks its limits, which needs + * q->limits_lock. Take it before suspending: its holder + * waits in blk_mq_freeze_queue() for I/O that + * mddev->suspended holds back, so the other order deadlocks. + / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } suspend = true; mddev_suspend(mddev, false); noio_flags = memalloc_noio_save(); @@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct ws) if (!suspend && (mddev->reshape_position == MaxSector \|\| !md_is_rdwr(mddev)) && md_spares_need_change(mddev)) { mddev_unlock(mddev); + /* see above: q->limits_lock nests outside both / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } mddev_suspend_and_lock_nointr(mddev); suspend = true; noio_flags = memalloc_noio_save(); @@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct ws) * As we only add devices that are already in-sync, we can * activate the spares immediately. / - remove_and_add_spares(mddev, NULL); + remove_and_add_spares(mddev, NULL, limp); goto not_running; } - if (!md_choose_sync_action(mddev, &spares)) + if (!md_choose_sync_action(mddev, &spares, limp)) goto not_running; if (!mddev->pers->sync_request) @@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct ws) * https://bugzilla.kernel.org/show_bug.cgi?id=218200 * Therefore, use __mddev_resume(mddev, false). / + if (limp) + queue_limits_commit_update(q, limp); if (suspend) { memalloc_noio_restore(noio_flags); __mddev_resume(mddev, false); @@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct ws) * https://bugzilla.kernel.org/show_bug.cgi?id=218200 * Therefore, use __mddev_resume(mddev, false). / + if (limp) + queue_limits_commit_update(q, limp); if (suspend) { memalloc_noio_restore(noio_flags); __mddev_resume(mddev, false); @@ -10793,6 +10965,7 @@ static int __init md_init(void) static void check_sb_changes(struct mddev mddev, struct md_rdev rdev) { + struct queue_limits lim; struct mdp_superblock_1 sb = page_address(rdev->sb_page); struct md_rdev rdev2, tmp; int role, ret; @@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev mddev, struct md_rdev rdev) rdev2->saved_raid_disk = -1; else rdev2->saved_raid_disk = role; - ret = remove_and_add_spares(mddev, rdev2); + /* + * reconfig_mutex is held, so don't wait for + * q->limits_lock; MD_RECOVERY_NEEDED below + * leaves a skipped add to md_start_sync(). + / + if (mddev_stack_limits_trylock(mddev, &lim)) { + struct request_queue q = + mddev->gendisk->queue; + + ret = remove_and_add_spares(mddev, + rdev2, &lim); + queue_limits_commit_update(q, &lim); + } else if (mddev_is_dm(mddev)) { + ret = remove_and_add_spares(mddev, + rdev2, NULL); + } else { + ret = remove_spares(mddev, rdev2); + } pr_info("Activated spare: %pg\n", rdev2->bdev); /* wakeup mddev->thread here, so array could diff --git a/drivers/md/md.h b/drivers/md/md.h index b6d2e8929a0f9..ceca8cfcdcb9e 100644 --- a/drivers/md/md.h +++ b/drivers/md/md.h @@ -765,7 +765,8 @@ struct md_personality * if appropriate, and should abort recovery if needed / void (error_handler)(struct mddev mddev, struct md_rdev rdev); - int (hot_add_disk) (struct mddev mddev, struct md_rdev rdev); + int (hot_add_disk)(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim); int (hot_remove_disk) (struct mddev mddev, struct md_rdev rdev); int (spare_active) (struct mddev mddev); sector_t (sync_request)(struct mddev mddev, sector_t sector_nr, @@ -1041,13 +1042,17 @@ struct mdu_disk_info_s; extern int mdp_major; void md_autostart_arrays(int part); int md_set_array_info(struct mddev mddev, struct mdu_array_info_s info); -int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info); +int md_add_new_disk(struct mddev mddev, struct mdu_disk_info_s info, + struct queue_limits lim); int do_md_run(struct mddev mddev); #define MDDEV_STACK_INTEGRITY (1u << 0) int mddev_stack_rdev_limits(struct mddev mddev, struct queue_limits lim, unsigned int flags); int mddev_stack_new_rdev(struct mddev mddev, struct md_rdev rdev); -void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes); +int mddev_stack_rdev_into(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim); +void mddev_update_io_opt(struct mddev mddev, unsigned int nr_stripes, + struct queue_limits lim); extern const struct block_device_operations md_fops; diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index f0646fb24371f..dd348b5695d06 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf conf, int disk) return true; } -static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r1conf conf = mddev->private; int err = -EEXIST; @@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev mddev, struct md_rdev rdev) for (mirror = first; mirror <= last; mirror++) { p = conf->mirrors + mirror; if (!p->rdev) { - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 1093c798d9dde..641619328a6c4 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev mddev) return count; } -static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r10conf conf = mddev->private; int err = -EEXIST; @@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) continue; } - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; p->head_position = 0; @@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev mddev, struct md_rdev rdev) clear_bit(In_sync, &rdev->flags); set_bit(Replacement, &rdev->flags); rdev->raid_disk = repl_slot; - err = mddev_stack_new_rdev(mddev, rdev); + if (lim) + err = mddev_stack_rdev_into(mddev, rdev, lim); + else + err = mddev_stack_new_rdev(mddev, rdev); if (err) return err; conf->fullsync = 1; @@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev mddev) rdev_for_each(rdev, mddev) if (rdev->raid_disk < 0 && !test_bit(Faulty, &rdev->flags)) { - if (raid10_add_disk(mddev, rdev) == 0) { + if (raid10_add_disk(mddev, rdev, NULL) == 0) { if (rdev->raid_disk >= conf->prev.raid_disks) set_bit(In_sync, &rdev->flags); @@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf conf) conf->reshape_safe = MaxSector; spin_unlock_irq(&conf->device_lock); - mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf)); + mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf), NULL); conf->fullsync = 0; } diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c index b91545ce090de..22759c631c4d9 100644 --- a/drivers/md/raid5.c +++ b/drivers/md/raid5.c @@ -7288,6 +7288,9 @@ static ssize_t raid5_store_skip_copy(struct mddev mddev, const char page, size_t len) { struct r5conf conf; + struct request_queue q = NULL; + struct queue_limits lim; + struct queue_limits limp = NULL; unsigned long new; int err; @@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev mddev, const char page, size_t len) return -EINVAL; new = !!new; + / q->limits_lock nests outside both, see md_start_sync() / + if (!mddev_is_dm(mddev)) { + q = mddev->gendisk->queue; + lim = queue_limits_start_update(q); + limp = &lim; + } + err = mddev_suspend_and_lock(mddev); - if (err) + if (err) { + if (limp) + queue_limits_cancel_update(q); return err; + } conf = mddev->private; if (!conf) err = -ENODEV; else if (new != conf->skip_copy) { - struct request_queue q = mddev->gendisk->queue; - struct queue_limits lim = queue_limits_start_update(q); - conf->skip_copy = new; - if (new) - lim.features \|= BLK_FEAT_STABLE_WRITES; - else - lim.features &= ~BLK_FEAT_STABLE_WRITES; - err = queue_limits_commit_update(q, &lim); + if (limp) { + if (new) + limp->features \|= BLK_FEAT_STABLE_WRITES; + else + limp->features &= ~BLK_FEAT_STABLE_WRITES; + } } + if (limp) + err = queue_limits_commit_update(q, limp) ?: err; mddev_unlock_and_resume(mddev); return err ?: len; } @@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev mddev, struct md_rdev rdev) return err; } -static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev) +static int raid5_add_disk(struct mddev mddev, struct md_rdev rdev, + struct queue_limits lim) { struct r5conf conf = mddev->private; int ret, err = -EEXIST; @@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev mddev) rdev_for_each(rdev, mddev) if (rdev->raid_disk < 0 && !test_bit(Faulty, &rdev->flags)) { - if (raid5_add_disk(mddev, rdev) == 0) { + if (raid5_add_disk(mddev, rdev, NULL) == 0) { if (rdev->raid_disk >= conf->previous_raid_disks) set_bit(In_sync, &rdev->flags); @@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf conf) wake_up(&conf->wait_for_reshape); mddev_update_io_opt(conf->mddev, - conf->raid_disks - conf->max_degraded); + conf->raid_disks - conf->max_degraded, NULL); } } diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 4f7905c3412b8..b75e85291e290 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue q) mutex_lock(&q->limits_lock); return q->limits; } + +/* + * queue_limits_start_update_trylock - try to start an atomic update of queue + * limits + * @q: queue to update + * @lim: returns a snapshot of the current limits on success + * + * Like queue_limits_start_update(), but fails instead of waiting when another + * update is in flight. For callers that must not block on q->limits_lock + * because they hold something its current owner is waiting for. + * + * Context: process context. + / +static inline bool +queue_limits_start_update_trylock(struct request_queue q, + struct queue_limits lim) + __cond_acquires(true, &q->limits_lock) +{ + if (!mutex_trylock(&q->limits_lock)) + return false; + + lim = q->limits; + + return true; +} + int queue_limits_commit_update_frozen(struct request_queue q, struct queue_limits lim) __releases(&q->limits_lock); int queue_limits_commit_update(struct request_queue *q,
21/3	2026/09/07 18:13	llm	kmsan-evaluator	0m Model: gemini-3.7-flash Args: null Results: null Tokens: input: 14577 output: 249 thoughts: 2338 Thoughts: Patch Evaluation: Uninitialized Memory Risks Alright, let's dive into this patch. My primary goal here is to determine if it introduces any new risks related to uninitialized memory access, warranting a KMSAN run. It seems the patch is primarily focused on addressing locking order and deadlock issues within the MD RAID code, particularly around `q->limits_lock` when updating queue limits. The core of the patch involves changing how `struct queue_limits` is handled. It appears that instead of directly manipulating `q->limits` within critical sections where deadlocks are possible, the patch introduces a local copy (`lim`) of `q->limits` via `queue_limits_start_update()`, which essentially copies the contents. This local copy is then passed to functions like `hot_add_disk`, `remove_and_add_spares`, etc. Crucially, the updates are then committed back via `queue_limits_commit_update()`. If a try lock fails, the functions should return. I've meticulously reviewed the code, specifically focusing on variable initialization, and the potential for uninitialized memory reads or leaks. I examined the instances where `struct queue_limits lim;` and `struct queue_limits limp = NULL;` are used across the patched functions. In each instance (`rdev_attr_store`, `md_ioctl`, `md_start_sync`, `check_sb_changes`, `mddev_update_io_opt`, `raid5_store_skip_copy` and `mddev_stack_rdev_into`), `lim` is always initialized before* it's referenced, primarily by `queue_limits_start_update()`, which returns `q->limits` by value. Even when a pointer to `lim` is passed, it is initialized. In the instances where the trylock is used, it fails before usage. `mddev_stack_rdev_into` copies the passed-in `lim`. The copy is used. I see no scenario where uninitialized data is being read or leaked. The patch appears to be a careful refactoring, improving locking and thus reliability. The critical data flow and initialization of the `lim` struct are safe, and there are no copies to user space that are modified. Considering this analysis, my assessment is that this patch does not introduce any new risks related to uninitialized memory. KMSAN is designed to catch specific types of memory errors that are not addressed in this patch. Given this is a refactor, KASAN, LOCKDEP and other standard bug detectors are the right tools here. Therefore, `NeedsKMSAN` should be set to `false`. I'm confident in this evaluation. Let's flag this as safe.
22/3	2026/09/07 18:13	tool	set-results	0m Args: { "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.", "NeedsKMSAN": false } Results:* { "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.", "NeedsKMSAN": false }

{
  "EnableConfigs": [
    "BLK_DEV_MD",
    "MD_RAID1",
    "MD_RAID10",
    "MD_RAID456",
    "MD_LINEAR",
    "DM_RAID"
  ],
  "FocusSymbols": [
    "mddev_stack_rdev_into",
    "mddev_update_io_opt",
    "md_add_new_disk",
    "remove_and_add_spares",
    "rdev_attr_store",
    "md_start_sync",
    "raid1_add_disk",
    "raid10_add_disk",
    "raid5_add_disk",
    "raid5_store_skip_copy",
    "linear_add"
  ],
  "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.",
  "NeedsKMSAN": false,
  "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.",
  "WorthFuzzing": true
}

{
  "PatchDiff": "commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e\nAuthor: syz-cluster \u003ctriage@syzkaller.com\u003e\nDate:   Mon Sep 7 18:13:15 2026 +0000\n\n    syz-cluster: applied patch under review\n\ndiff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c\nindex 8f5a5e1342a95..21a1922bee4fb 100644\n--- a/drivers/md/dm-raid.c\n+++ b/drivers/md/dm-raid.c\n@@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)\n \t\t\tclear_bit(Faulty, \u0026r-\u003eflags);\n \t\t\tclear_bit(WriteErrorSeen, \u0026r-\u003eflags);\n \n-\t\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, r)) {\n+\t\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, r, NULL)) {\n \t\t\t\t/* Failed to revive this device, try next */\n \t\t\t\tr-\u003eraid_disk = r-\u003esaved_raid_disk = -1;\n \t\t\t\tr-\u003eflags = flags;\ndiff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c\nindex 4b80165afd233..929513109657f 100644\n--- a/drivers/md/md-autodetect.c\n+++ b/drivers/md/md-autodetect.c\n@@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args *args)\n \t\t\t\t(1 \u003c\u003c MD_DISK_ACTIVE) | (1 \u003c\u003c MD_DISK_SYNC);\n \t\t}\n \n-\t\tmd_add_new_disk(mddev, \u0026dinfo);\n+\t\tmd_add_new_disk(mddev, \u0026dinfo, NULL);\n \t}\n \n \tif (!err)\ndiff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c\nindex 73b367b61b873..1f44c2d7db93d 100644\n--- a/drivers/md/md-linear.c\n+++ b/drivers/md/md-linear.c\n@@ -186,7 +186,8 @@ static int linear_run(struct mddev *mddev)\n \treturn ret;\n }\n \n-static int linear_add(struct mddev *mddev, struct md_rdev *rdev)\n+static int linear_add(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t      struct queue_limits *lim)\n {\n \t/* Adding a drive to a linear array allows the array to grow.\n \t * It is permitted if the new drive has a matching superblock\ndiff --git a/drivers/md/md.c b/drivers/md/md.c\nindex 680b34a63cb3d..c4054d06d1070 100644\n--- a/drivers/md/md.c\n+++ b/drivers/md/md.c\n@@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);\n  */\n static struct workqueue_struct *md_misc_wq;\n \n-static int remove_and_add_spares(struct mddev *mddev,\n-\t\t\t\t struct md_rdev *this);\n+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,\n+\t\t\t\t struct queue_limits *lim);\n static void mddev_detach(struct mddev *mddev);\n static void export_rdev(struct md_rdev *rdev);\n static void md_wakeup_thread_directly(struct md_thread __rcu **thread);\n@@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev *mddev, int force_change)\n }\n EXPORT_SYMBOL(md_update_sb);\n \n-static int add_bound_rdev(struct md_rdev *rdev)\n+static int add_bound_rdev(struct md_rdev *rdev, struct queue_limits *lim)\n {\n \tstruct mddev *mddev = rdev-\u003emddev;\n \tint err = 0;\n@@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev *rdev)\n \t\t */\n \t\tsuper_types[mddev-\u003emajor_version].\n \t\t\tvalidate_super(mddev, NULL/*freshest*/, rdev);\n-\t\terr = mddev-\u003epers-\u003ehot_add_disk(mddev, rdev);\n+\t\terr = mddev-\u003epers-\u003ehot_add_disk(mddev, rdev, lim);\n \t\tif (err) {\n \t\t\tmd_kick_rdev_from_array(rdev);\n \t\t\treturn err;\n@@ -3033,7 +3033,13 @@ static int cmd_match(const char *cmd, const char *str)\n struct rdev_sysfs_entry {\n \tstruct attribute attr;\n \tssize_t (*show)(struct md_rdev *, char *);\n-\tssize_t (*store)(struct md_rdev *, const char *, size_t);\n+\t/*\n+\t * @lim: a queue limits update the caller owns, or NULL.  Stores that\n+\t * can add a leg to the array must stack into it rather than take\n+\t * q-\u003elimits_lock themselves, see md_start_sync().\n+\t */\n+\tssize_t (*store)(struct md_rdev *rdev, const char *page, size_t len,\n+\t\t\t struct queue_limits *lim);\n };\n \n static ssize_t\n@@ -3079,7 +3085,8 @@ state_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-state_store(struct md_rdev *rdev, const char *buf, size_t len)\n+state_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t    struct queue_limits *lim)\n {\n \t/* can write\n \t *  faulty  - simulates an error\n@@ -3110,7 +3117,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)\n \t} else if (cmd_match(buf, \"remove\")) {\n \t\tif (rdev-\u003emddev-\u003epers) {\n \t\t\tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\t\t\tremove_and_add_spares(rdev-\u003emddev, rdev);\n+\t\t\tremove_and_add_spares(rdev-\u003emddev, rdev, lim);\n \t\t}\n \t\tif (rdev-\u003eraid_disk \u003e= 0)\n \t\t\terr = -EBUSY;\n@@ -3229,7 +3236,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)\n \t\t\tif (!mddev_is_clustered(rdev-\u003emddev) ||\n \t\t\t    (err = mddev-\u003ecluster_ops-\u003egather_bitmaps(rdev)) == 0) {\n \t\t\t\tclear_bit(Faulty, \u0026rdev-\u003eflags);\n-\t\t\t\terr = add_bound_rdev(rdev);\n+\t\t\t\terr = add_bound_rdev(rdev, lim);\n \t\t\t}\n \t\t} else\n \t\t\terr = -EBUSY;\n@@ -3257,7 +3264,8 @@ errors_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-errors_store(struct md_rdev *rdev, const char *buf, size_t len)\n+errors_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t     struct queue_limits *lim)\n {\n \tunsigned int n;\n \tint rv;\n@@ -3283,7 +3291,8 @@ slot_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-slot_store(struct md_rdev *rdev, const char *buf, size_t len)\n+slot_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t   struct queue_limits *lim)\n {\n \tint slot;\n \tint err;\n@@ -3314,7 +3323,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)\n \t\tif (rdev-\u003emddev-\u003epers-\u003ehot_remove_disk == NULL)\n \t\t\treturn -EINVAL;\n \t\tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\t\tremove_and_add_spares(rdev-\u003emddev, rdev);\n+\t\tremove_and_add_spares(rdev-\u003emddev, rdev, lim);\n \t\tif (rdev-\u003eraid_disk \u003e= 0)\n \t\t\treturn -EBUSY;\n \t\tset_bit(MD_RECOVERY_NEEDED, \u0026rdev-\u003emddev-\u003erecovery);\n@@ -3344,7 +3353,8 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)\n \t\t\trdev-\u003esaved_raid_disk = -1;\n \t\tclear_bit(In_sync, \u0026rdev-\u003eflags);\n \t\tclear_bit(Bitmap_sync, \u0026rdev-\u003eflags);\n-\t\terr = rdev-\u003emddev-\u003epers-\u003ehot_add_disk(rdev-\u003emddev, rdev);\n+\t\terr = rdev-\u003emddev-\u003epers-\u003ehot_add_disk(rdev-\u003emddev, rdev,\n+\t\t\t\t\t\t     lim);\n \t\tif (err) {\n \t\t\trdev-\u003eraid_disk = -1;\n \t\t\treturn err;\n@@ -3377,7 +3387,8 @@ offset_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-offset_store(struct md_rdev *rdev, const char *buf, size_t len)\n+offset_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t     struct queue_limits *lim)\n {\n \tunsigned long long offset;\n \tif (kstrtoull(buf, 10, \u0026offset) \u003c 0)\n@@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t new_offset_store(struct md_rdev *rdev,\n-\t\t\t\tconst char *buf, size_t len)\n+\t\t\t\tconst char *buf, size_t len,\n+\t\t\t\tstruct queue_limits *lim)\n {\n \tunsigned long long new_offset;\n \tstruct mddev *mddev = rdev-\u003emddev;\n@@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char *buf, sector_t *sectors)\n }\n \n static ssize_t\n-rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)\n+rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t\tstruct queue_limits *lim)\n {\n \tstruct mddev *my_mddev = rdev-\u003emddev;\n \tsector_t oldsectors = rdev-\u003esectors;\n@@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev *rdev, char *page)\n \treturn sprintf(page, \"%llu\\n\", recovery_start);\n }\n \n-static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len)\n+static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t\t\t\t    struct queue_limits *lim)\n {\n \tunsigned long long recovery_start;\n \n@@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev *rdev, char *page)\n {\n \treturn badblocks_show(\u0026rdev-\u003ebadblocks, page, 0);\n }\n-static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len)\n+\n+static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len,\n+\t\t\tstruct queue_limits *lim)\n {\n \tint rv = badblocks_store(\u0026rdev-\u003ebadblocks, page, len, 0);\n \t/* Maybe that ack was all we needed */\n@@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev *rdev, char *page)\n {\n \treturn badblocks_show(\u0026rdev-\u003ebadblocks, page, 1);\n }\n-static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len)\n+\n+static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len,\n+\t\t\t struct queue_limits *lim)\n {\n \treturn badblocks_store(\u0026rdev-\u003ebadblocks, page, len, 1);\n }\n@@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len)\n+ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t\t struct queue_limits *lim)\n {\n \tunsigned long long sector;\n \n@@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev *rdev, char *page)\n }\n \n static ssize_t\n-ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len)\n+ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len,\n+\t       struct queue_limits *lim)\n {\n \tunsigned int size;\n \n@@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,\n \tstruct rdev_sysfs_entry *entry = container_of(attr, struct rdev_sysfs_entry, attr);\n \tstruct md_rdev *rdev = container_of(kobj, struct md_rdev, kobj);\n \tstruct kernfs_node *kn = NULL;\n+\tstruct request_queue *q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits *limp = NULL;\n \tbool suspend = false;\n \tssize_t rv;\n \tstruct mddev *mddev = READ_ONCE(rdev-\u003emddev);\n@@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,\n \t\t\tsuspend = true;\n \t}\n \n+\t/*\n+\t * These can add a leg back, which stacks its limits; the other\n+\t * state_store() values never reach -\u003ehot_add_disk().  q-\u003elimits_lock\n+\t * nests outside the lock and the suspend, see md_start_sync().\n+\t */\n+\tif ((entry-\u003estore == slot_store ||\n+\t     (entry-\u003estore == state_store \u0026\u0026\n+\t      (cmd_match(page, \"remove\") || cmd_match(page, \"re-add\")))) \u0026\u0026\n+\t    !mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \trv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);\n \tif (!rv) {\n \t\tif (rdev-\u003emddev == NULL)\n \t\t\trv = -ENODEV;\n \t\telse\n-\t\t\trv = entry-\u003estore(rdev, page, length);\n+\t\t\trv = entry-\u003estore(rdev, page, length, limp);\n+\t\t/* apply the limits before the array takes I/O again */\n+\t\tif (limp) {\n+\t\t\tqueue_limits_commit_update(q, limp);\n+\t\t\tlimp = NULL;\n+\t\t}\n \t\tsuspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev);\n \t}\n \n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n+\n \tif (kn)\n \t\tsysfs_unbreak_active_protection(kn);\n \n@@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev)\n }\n EXPORT_SYMBOL_GPL(mddev_stack_new_rdev);\n \n+/*\n+ * Stack a new rdev into limits the caller already holds limits_lock for and\n+ * will commit itself.  Used from paths that must take limits_lock before\n+ * quiescing the array, see md_start_sync().\n+ */\n+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t  struct queue_limits *lim)\n+{\n+\tstruct queue_limits tmp = *lim;\n+\n+\tif (mddev_is_dm(mddev))\n+\t\treturn 0;\n+\n+\tif (queue_logical_block_size(rdev-\u003ebdev-\u003ebd_disk-\u003equeue) \u003e\n+\t    queue_logical_block_size(mddev-\u003egendisk-\u003equeue)) {\n+\t\tpr_err(\"%s: incompatible logical_block_size, can not add\\n\",\n+\t\t       mdname(mddev));\n+\t\treturn -EINVAL;\n+\t}\n+\n+\tqueue_limits_stack_bdev(\u0026tmp, rdev-\u003ebdev, rdev-\u003edata_offset,\n+\t\t\t\tmddev-\u003egendisk-\u003edisk_name);\n+\n+\tif (!queue_limits_stack_integrity_bdev(\u0026tmp, rdev-\u003ebdev)) {\n+\t\tpr_err(\"%s: incompatible integrity profile for %pg\\n\",\n+\t\t       mdname(mddev), rdev-\u003ebdev);\n+\t\treturn -ENXIO;\n+\t}\n+\n+\t*lim = tmp;\n+\treturn 0;\n+}\n+EXPORT_SYMBOL_GPL(mddev_stack_rdev_into);\n+\n+/* for callers that must not wait for q-\u003elimits_lock, see md_start_sync() */\n+static bool mddev_stack_limits_trylock(struct mddev *mddev,\n+\t\t\t\t       struct queue_limits *lim)\n+{\n+\tstruct request_queue *q;\n+\n+\tif (mddev_is_dm(mddev))\n+\t\treturn false;\n+\n+\tq = mddev-\u003egendisk-\u003equeue;\n+\n+\treturn queue_limits_start_update_trylock(q, lim);\n+}\n+\n /* update the optimal I/O size after a reshape */\n-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes)\n+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,\n+\t\t\t struct queue_limits *lim)\n {\n-\tstruct queue_limits lim;\n+\tstruct queue_limits own;\n \n \tif (mddev_is_dm(mddev))\n \t\treturn;\n \n+\t/*\n+\t * With an update owned by the caller just change it in place; it is\n+\t * committed, and the array resumed, by whoever started it.  Taking\n+\t * q-\u003elimits_lock here would nest it inside reconfig_mutex and the\n+\t * suspend, which deadlocks, see md_start_sync().\n+\t */\n+\tif (lim) {\n+\t\tlim-\u003eio_opt = lim-\u003eio_min * nr_stripes;\n+\t\treturn;\n+\t}\n+\n+\t/*\n+\t * Called from the sync thread, which md_reap_sync_thread() waits for\n+\t * with reconfig_mutex held, so don't wait for q-\u003elimits_lock here.\n+\t * io_opt is a hint, skipping it on a contended pass is fine.\n+\t */\n+\tif (!mddev_stack_limits_trylock(mddev, \u0026own))\n+\t\treturn;\n+\n \t/* don't bother updating io_opt if we can't suspend the array */\n-\tif (mddev_suspend(mddev, false) \u003c 0)\n+\tif (mddev_suspend(mddev, false) \u003c 0) {\n+\t\tqueue_limits_cancel_update(mddev-\u003egendisk-\u003equeue);\n \t\treturn;\n-\tlim = queue_limits_start_update(mddev-\u003egendisk-\u003equeue);\n-\tlim.io_opt = lim.io_min * nr_stripes;\n-\tqueue_limits_commit_update(mddev-\u003egendisk-\u003equeue, \u0026lim);\n+\t}\n+\town.io_opt = own.io_min * nr_stripes;\n+\tqueue_limits_commit_update(mddev-\u003egendisk-\u003equeue, \u0026own);\n \tmddev_resume(mddev);\n }\n EXPORT_SYMBOL_GPL(mddev_update_io_opt);\n@@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev *mddev, void __user * arg)\n \treturn 0;\n }\n \n-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)\n+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,\n+\t\t    struct queue_limits *lim)\n {\n \tstruct md_rdev *rdev;\n \tdev_t dev = MKDEV(info-\u003emajor,info-\u003eminor);\n@@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)\n \t\t\t\tif (err)\n \t\t\t\t\tmddev-\u003ecluster_ops-\u003eadd_new_disk_cancel(mddev);\n \t\t\t\telse\n-\t\t\t\t\terr = add_bound_rdev(rdev);\n+\t\t\t\t\terr = add_bound_rdev(rdev, lim);\n \t\t\t}\n \n \t\t} else if (!err)\n-\t\t\terr = add_bound_rdev(rdev);\n+\t\t\terr = add_bound_rdev(rdev, lim);\n \n \t\treturn err;\n \t}\n@@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)\n \treturn 0;\n }\n \n-static int hot_remove_disk(struct mddev *mddev, dev_t dev)\n+static int hot_remove_disk(struct mddev *mddev, dev_t dev,\n+\t\t\t   struct queue_limits *lim)\n {\n \tstruct md_rdev *rdev;\n \n@@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev)\n \t\tgoto kick_rdev;\n \n \tclear_bit(Blocked, \u0026rdev-\u003eflags);\n-\tremove_and_add_spares(mddev, rdev);\n+\tremove_and_add_spares(mddev, rdev, lim);\n \n \tif (rdev-\u003eraid_disk \u003e= 0)\n \t\tgoto busy;\n@@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd)\n \t}\n }\n \n+/*\n+ * Commands that can reach -\u003ehot_add_disk().  ADD_NEW_DISK only does so for a\n+ * journal device or a personality without -\u003ehot_remove_disk, but that depends\n+ * on disk info still in user memory here, so it is included as a whole.\n+ */\n+static bool md_ioctl_may_add_disk(unsigned int cmd)\n+{\n+\tswitch (cmd) {\n+\tcase ADD_NEW_DISK:\n+\tcase HOT_REMOVE_DISK:\n+\t\treturn true;\n+\tdefault:\n+\t\treturn false;\n+\t}\n+}\n+\n static bool md_ioctl_need_suspend(unsigned int cmd)\n {\n \tswitch (cmd) {\n@@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \tunsigned int noio_flags = 0;\n \tvoid __user *argp = (void __user *)arg;\n \tstruct mddev *mddev = NULL;\n+\tstruct request_queue *q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits *limp = NULL;\n \tbool suspend;\n \n \terr = md_ioctl_valid(cmd);\n@@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \tif (!md_is_rdwr(mddev))\n \t\tflush_work(\u0026mddev-\u003esync_work);\n \n+\t/* q-\u003elimits_lock nests outside both, see md_start_sync() */\n+\tif (md_ioctl_may_add_disk(cmd) \u0026\u0026 !mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \tsuspend = md_ioctl_need_suspend(cmd);\n \terr = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);\n \tif (err) {\n \t\tpr_debug(\"md: ioctl lock interrupted, reason %d, cmd %d\\n\",\n \t\t\t err, cmd);\n+\t\tif (limp)\n+\t\t\tqueue_limits_cancel_update(q);\n \t\tgoto out;\n \t}\n \tif (suspend)\n@@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \t\tgoto unlock;\n \n \tcase HOT_REMOVE_DISK:\n-\t\terr = hot_remove_disk(mddev, new_decode_dev(arg));\n+\t\terr = hot_remove_disk(mddev, new_decode_dev(arg), limp);\n \t\tgoto unlock;\n \n \tcase ADD_NEW_DISK:\n@@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \t\t\t\t/* Need to clear read-only for this */\n \t\t\t\tbreak;\n \t\t\telse\n-\t\t\t\terr = md_add_new_disk(mddev, \u0026info);\n+\t\t\t\terr = md_add_new_disk(mddev, \u0026info, limp);\n \t\t\tgoto unlock;\n \t\t}\n \t\tbreak;\n@@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \t\tif (copy_from_user(\u0026info, argp, sizeof(info)))\n \t\t\terr = -EFAULT;\n \t\telse\n-\t\t\terr = md_add_new_disk(mddev, \u0026info);\n+\t\t\terr = md_add_new_disk(mddev, \u0026info, limp);\n \t\tgoto unlock;\n \t}\n \n@@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,\n \t    err != -EINVAL)\n \t\tmddev-\u003ehold_active = 0;\n \n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n+\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\tmddev_unlock_and_resume(mddev);\n@@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev *mddev, struct md_rdev *this)\n \treturn removed;\n }\n \n-static int remove_and_add_spares(struct mddev *mddev,\n-\t\t\t\t struct md_rdev *this)\n+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,\n+\t\t\t\t struct queue_limits *lim)\n {\n \tstruct md_rdev *rdev;\n \tint spares = 0;\n@@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev *mddev,\n \t\t\tcontinue;\n \t\tif (!test_bit(Journal, \u0026rdev-\u003eflags))\n \t\t\trdev-\u003erecovery_offset = 0;\n-\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, rdev) == 0) {\n+\t\tif (mddev-\u003epers-\u003ehot_add_disk(mddev, rdev, lim) == 0) {\n \t\t\t/* failure here is OK */\n \t\t\tsysfs_link_rdev(mddev, rdev);\n \t\t\tif (!test_bit(Journal, \u0026rdev-\u003eflags))\n@@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev *mddev,\n \treturn spares;\n }\n \n-static bool md_choose_sync_action(struct mddev *mddev, int *spares)\n+static bool md_choose_sync_action(struct mddev *mddev, int *spares,\n+\t\t\t\t  struct queue_limits *lim)\n {\n \t/* Check if reshape is in progress first. */\n \tif (mddev-\u003ereshape_position != MaxSector) {\n@@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)\n \t * also removed and re-added, to allow the personality to fail the\n \t * re-add.\n \t */\n-\t*spares = remove_and_add_spares(mddev, NULL);\n+\t*spares = remove_and_add_spares(mddev, NULL, lim);\n \tif (*spares || test_bit(MD_RECOVERY_LAZY_RECOVER, \u0026mddev-\u003erecovery)) {\n \t\tclear_bit(MD_RECOVERY_SYNC, \u0026mddev-\u003erecovery);\n \t\tclear_bit(MD_RECOVERY_CHECK, \u0026mddev-\u003erecovery);\n@@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)\n static void md_start_sync(struct work_struct *ws)\n {\n \tstruct mddev *mddev = container_of(ws, struct mddev, sync_work);\n+\tstruct request_queue *q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits *limp = NULL;\n \tint spares = 0;\n \tbool suspend = false;\n \tunsigned int noio_flags = 0;\n@@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct *ws)\n \t */\n \tif ((mddev-\u003ereshape_position == MaxSector || !md_is_rdwr(mddev)) \u0026\u0026\n \t    md_spares_need_change(mddev)) {\n+\t\t/*\n+\t\t * Adding a spare below stacks its limits, which needs\n+\t\t * q-\u003elimits_lock.  Take it before suspending: its holder\n+\t\t * waits in blk_mq_freeze_queue() for I/O that\n+\t\t * mddev-\u003esuspended holds back, so the other order deadlocks.\n+\t\t */\n+\t\tif (!mddev_is_dm(mddev)) {\n+\t\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\t\tlim = queue_limits_start_update(q);\n+\t\t\tlimp = \u0026lim;\n+\t\t}\n \t\tsuspend = true;\n \t\tmddev_suspend(mddev, false);\n \t\tnoio_flags = memalloc_noio_save();\n@@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct *ws)\n \tif (!suspend \u0026\u0026 (mddev-\u003ereshape_position == MaxSector || !md_is_rdwr(mddev)) \u0026\u0026\n \t    md_spares_need_change(mddev)) {\n \t\tmddev_unlock(mddev);\n+\t\t/* see above: q-\u003elimits_lock nests outside both */\n+\t\tif (!mddev_is_dm(mddev)) {\n+\t\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\t\tlim = queue_limits_start_update(q);\n+\t\t\tlimp = \u0026lim;\n+\t\t}\n \t\tmddev_suspend_and_lock_nointr(mddev);\n \t\tsuspend = true;\n \t\tnoio_flags = memalloc_noio_save();\n@@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct *ws)\n \t\t * As we only add devices that are already in-sync, we can\n \t\t * activate the spares immediately.\n \t\t */\n-\t\tremove_and_add_spares(mddev, NULL);\n+\t\tremove_and_add_spares(mddev, NULL, limp);\n \t\tgoto not_running;\n \t}\n \n-\tif (!md_choose_sync_action(mddev, \u0026spares))\n+\tif (!md_choose_sync_action(mddev, \u0026spares, limp))\n \t\tgoto not_running;\n \n \tif (!mddev-\u003epers-\u003esync_request)\n@@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct *ws)\n \t *     https://bugzilla.kernel.org/show_bug.cgi?id=218200\n \t * Therefore, use __mddev_resume(mddev, false).\n \t */\n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\t__mddev_resume(mddev, false);\n@@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct *ws)\n \t *     https://bugzilla.kernel.org/show_bug.cgi?id=218200\n \t * Therefore, use __mddev_resume(mddev, false).\n \t */\n+\tif (limp)\n+\t\tqueue_limits_commit_update(q, limp);\n \tif (suspend) {\n \t\tmemalloc_noio_restore(noio_flags);\n \t\t__mddev_resume(mddev, false);\n@@ -10793,6 +10965,7 @@ static int __init md_init(void)\n \n static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)\n {\n+\tstruct queue_limits lim;\n \tstruct mdp_superblock_1 *sb = page_address(rdev-\u003esb_page);\n \tstruct md_rdev *rdev2, *tmp;\n \tint role, ret;\n@@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)\n \t\t\t\t\trdev2-\u003esaved_raid_disk = -1;\n \t\t\t\telse\n \t\t\t\t\trdev2-\u003esaved_raid_disk = role;\n-\t\t\t\tret = remove_and_add_spares(mddev, rdev2);\n+\t\t\t\t/*\n+\t\t\t\t * reconfig_mutex is held, so don't wait for\n+\t\t\t\t * q-\u003elimits_lock; MD_RECOVERY_NEEDED below\n+\t\t\t\t * leaves a skipped add to md_start_sync().\n+\t\t\t\t */\n+\t\t\t\tif (mddev_stack_limits_trylock(mddev, \u0026lim)) {\n+\t\t\t\t\tstruct request_queue *q =\n+\t\t\t\t\t\tmddev-\u003egendisk-\u003equeue;\n+\n+\t\t\t\t\tret = remove_and_add_spares(mddev,\n+\t\t\t\t\t\t\t\t    rdev2, \u0026lim);\n+\t\t\t\t\tqueue_limits_commit_update(q, \u0026lim);\n+\t\t\t\t} else if (mddev_is_dm(mddev)) {\n+\t\t\t\t\tret = remove_and_add_spares(mddev,\n+\t\t\t\t\t\t\t\t    rdev2, NULL);\n+\t\t\t\t} else {\n+\t\t\t\t\tret = remove_spares(mddev, rdev2);\n+\t\t\t\t}\n \t\t\t\tpr_info(\"Activated spare: %pg\\n\",\n \t\t\t\t\trdev2-\u003ebdev);\n \t\t\t\t/* wakeup mddev-\u003ethread here, so array could\ndiff --git a/drivers/md/md.h b/drivers/md/md.h\nindex b6d2e8929a0f9..ceca8cfcdcb9e 100644\n--- a/drivers/md/md.h\n+++ b/drivers/md/md.h\n@@ -765,7 +765,8 @@ struct md_personality\n \t * if appropriate, and should abort recovery if needed\n \t */\n \tvoid (*error_handler)(struct mddev *mddev, struct md_rdev *rdev);\n-\tint (*hot_add_disk) (struct mddev *mddev, struct md_rdev *rdev);\n+\tint (*hot_add_disk)(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t    struct queue_limits *lim);\n \tint (*hot_remove_disk) (struct mddev *mddev, struct md_rdev *rdev);\n \tint (*spare_active) (struct mddev *mddev);\n \tsector_t (*sync_request)(struct mddev *mddev, sector_t sector_nr,\n@@ -1041,13 +1042,17 @@ struct mdu_disk_info_s;\n extern int mdp_major;\n void md_autostart_arrays(int part);\n int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info);\n-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info);\n+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,\n+\t\t    struct queue_limits *lim);\n int do_md_run(struct mddev *mddev);\n #define MDDEV_STACK_INTEGRITY\t(1u \u003c\u003c 0)\n int mddev_stack_rdev_limits(struct mddev *mddev, struct queue_limits *lim,\n \t\tunsigned int flags);\n int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev);\n-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes);\n+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t  struct queue_limits *lim);\n+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,\n+\t\t\t struct queue_limits *lim);\n \n extern const struct block_device_operations md_fops;\n \ndiff --git a/drivers/md/raid1.c b/drivers/md/raid1.c\nindex f0646fb24371f..dd348b5695d06 100644\n--- a/drivers/md/raid1.c\n+++ b/drivers/md/raid1.c\n@@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf *conf, int disk)\n \treturn true;\n }\n \n-static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n+static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t  struct queue_limits *lim)\n {\n \tstruct r1conf *conf = mddev-\u003eprivate;\n \tint err = -EEXIST;\n@@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n \tfor (mirror = first; mirror \u003c= last; mirror++) {\n \t\tp = conf-\u003emirrors + mirror;\n \t\tif (!p-\u003erdev) {\n-\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\t\tif (lim)\n+\t\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\t\telse\n+\t\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\t\tif (err)\n \t\t\t\treturn err;\n \ndiff --git a/drivers/md/raid10.c b/drivers/md/raid10.c\nindex 1093c798d9dde..641619328a6c4 100644\n--- a/drivers/md/raid10.c\n+++ b/drivers/md/raid10.c\n@@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev *mddev)\n \treturn count;\n }\n \n-static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n+static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t   struct queue_limits *lim)\n {\n \tstruct r10conf *conf = mddev-\u003eprivate;\n \tint err = -EEXIST;\n@@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n \t\t\tcontinue;\n \t\t}\n \n-\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\tif (lim)\n+\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\telse\n+\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\tif (err)\n \t\t\treturn err;\n \t\tp-\u003ehead_position = 0;\n@@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n \t\tclear_bit(In_sync, \u0026rdev-\u003eflags);\n \t\tset_bit(Replacement, \u0026rdev-\u003eflags);\n \t\trdev-\u003eraid_disk = repl_slot;\n-\t\terr = mddev_stack_new_rdev(mddev, rdev);\n+\t\tif (lim)\n+\t\t\terr = mddev_stack_rdev_into(mddev, rdev, lim);\n+\t\telse\n+\t\t\terr = mddev_stack_new_rdev(mddev, rdev);\n \t\tif (err)\n \t\t\treturn err;\n \t\tconf-\u003efullsync = 1;\n@@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev *mddev)\n \t\trdev_for_each(rdev, mddev)\n \t\t\tif (rdev-\u003eraid_disk \u003c 0 \u0026\u0026\n \t\t\t    !test_bit(Faulty, \u0026rdev-\u003eflags)) {\n-\t\t\t\tif (raid10_add_disk(mddev, rdev) == 0) {\n+\t\t\t\tif (raid10_add_disk(mddev, rdev, NULL) == 0) {\n \t\t\t\t\tif (rdev-\u003eraid_disk \u003e=\n \t\t\t\t\t    conf-\u003eprev.raid_disks)\n \t\t\t\t\t\tset_bit(In_sync, \u0026rdev-\u003eflags);\n@@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf *conf)\n \tconf-\u003ereshape_safe = MaxSector;\n \tspin_unlock_irq(\u0026conf-\u003edevice_lock);\n \n-\tmddev_update_io_opt(conf-\u003emddev, raid10_nr_stripes(conf));\n+\tmddev_update_io_opt(conf-\u003emddev, raid10_nr_stripes(conf), NULL);\n \tconf-\u003efullsync = 0;\n }\n \ndiff --git a/drivers/md/raid5.c b/drivers/md/raid5.c\nindex b91545ce090de..22759c631c4d9 100644\n--- a/drivers/md/raid5.c\n+++ b/drivers/md/raid5.c\n@@ -7288,6 +7288,9 @@ static ssize_t\n raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)\n {\n \tstruct r5conf *conf;\n+\tstruct request_queue *q = NULL;\n+\tstruct queue_limits lim;\n+\tstruct queue_limits *limp = NULL;\n \tunsigned long new;\n \tint err;\n \n@@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)\n \t\treturn -EINVAL;\n \tnew = !!new;\n \n+\t/* q-\u003elimits_lock nests outside both, see md_start_sync() */\n+\tif (!mddev_is_dm(mddev)) {\n+\t\tq = mddev-\u003egendisk-\u003equeue;\n+\t\tlim = queue_limits_start_update(q);\n+\t\tlimp = \u0026lim;\n+\t}\n+\n \terr = mddev_suspend_and_lock(mddev);\n-\tif (err)\n+\tif (err) {\n+\t\tif (limp)\n+\t\t\tqueue_limits_cancel_update(q);\n \t\treturn err;\n+\t}\n \tconf = mddev-\u003eprivate;\n \tif (!conf)\n \t\terr = -ENODEV;\n \telse if (new != conf-\u003eskip_copy) {\n-\t\tstruct request_queue *q = mddev-\u003egendisk-\u003equeue;\n-\t\tstruct queue_limits lim = queue_limits_start_update(q);\n-\n \t\tconf-\u003eskip_copy = new;\n-\t\tif (new)\n-\t\t\tlim.features |= BLK_FEAT_STABLE_WRITES;\n-\t\telse\n-\t\t\tlim.features \u0026= ~BLK_FEAT_STABLE_WRITES;\n-\t\terr = queue_limits_commit_update(q, \u0026lim);\n+\t\tif (limp) {\n+\t\t\tif (new)\n+\t\t\t\tlimp-\u003efeatures |= BLK_FEAT_STABLE_WRITES;\n+\t\t\telse\n+\t\t\t\tlimp-\u003efeatures \u0026= ~BLK_FEAT_STABLE_WRITES;\n+\t\t}\n \t}\n+\tif (limp)\n+\t\terr = queue_limits_commit_update(q, limp) ?: err;\n \tmddev_unlock_and_resume(mddev);\n \treturn err ?: len;\n }\n@@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)\n \treturn err;\n }\n \n-static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)\n+static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev,\n+\t\t\t  struct queue_limits *lim)\n {\n \tstruct r5conf *conf = mddev-\u003eprivate;\n \tint ret, err = -EEXIST;\n@@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev *mddev)\n \t\trdev_for_each(rdev, mddev)\n \t\t\tif (rdev-\u003eraid_disk \u003c 0 \u0026\u0026\n \t\t\t    !test_bit(Faulty, \u0026rdev-\u003eflags)) {\n-\t\t\t\tif (raid5_add_disk(mddev, rdev) == 0) {\n+\t\t\t\tif (raid5_add_disk(mddev, rdev, NULL) == 0) {\n \t\t\t\t\tif (rdev-\u003eraid_disk\n \t\t\t\t\t    \u003e= conf-\u003eprevious_raid_disks)\n \t\t\t\t\t\tset_bit(In_sync, \u0026rdev-\u003eflags);\n@@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf *conf)\n \t\twake_up(\u0026conf-\u003ewait_for_reshape);\n \n \t\tmddev_update_io_opt(conf-\u003emddev,\n-\t\t\tconf-\u003eraid_disks - conf-\u003emax_degraded);\n+\t\t\tconf-\u003eraid_disks - conf-\u003emax_degraded, NULL);\n \t}\n }\n \ndiff --git a/include/linux/blkdev.h b/include/linux/blkdev.h\nindex 4f7905c3412b8..b75e85291e290 100644\n--- a/include/linux/blkdev.h\n+++ b/include/linux/blkdev.h\n@@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue *q)\n \tmutex_lock(\u0026q-\u003elimits_lock);\n \treturn q-\u003elimits;\n }\n+\n+/**\n+ * queue_limits_start_update_trylock - try to start an atomic update of queue\n+ *\tlimits\n+ * @q:\t\tqueue to update\n+ * @lim:\treturns a snapshot of the current limits on success\n+ *\n+ * Like queue_limits_start_update(), but fails instead of waiting when another\n+ * update is in flight.  For callers that must not block on q-\u003elimits_lock\n+ * because they hold something its current owner is waiting for.\n+ *\n+ * Context: process context.\n+ */\n+static inline bool\n+queue_limits_start_update_trylock(struct request_queue *q,\n+\t\t\t\t  struct queue_limits *lim)\n+\t__cond_acquires(true, \u0026q-\u003elimits_lock)\n+{\n+\tif (!mutex_trylock(\u0026q-\u003elimits_lock))\n+\t\treturn false;\n+\n+\t*lim = q-\u003elimits;\n+\n+\treturn true;\n+}\n+\n int queue_limits_commit_update_frozen(struct request_queue *q,\n \t\tstruct queue_limits *lim) __releases(\u0026q-\u003elimits_lock);\n int queue_limits_commit_update(struct request_queue *q,\n"
}

{
  "EnableConfigs": [
    "BLK_DEV_MD",
    "MD_RAID1",
    "MD_RAID10",
    "MD_RAID456",
    "MD_LINEAR",
    "DM_RAID"
  ],
  "FocusSymbols": [
    "mddev_stack_rdev_into",
    "mddev_update_io_opt",
    "md_add_new_disk",
    "remove_and_add_spares",
    "rdev_attr_store",
    "md_start_sync",
    "raid1_add_disk",
    "raid10_add_disk",
    "raid5_add_disk",
    "raid5_store_skip_copy",
    "linear_add"
  ],
  "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.",
  "WorthFuzzing": true
}

You are an expert Linux kernel maintainer and security engineer.
Your job is to review a provided patch series and evaluate whether it warrants fuzzing with syzkaller.

IMPORTANT: The changes have ALREADY been applied and committed as the HEAD commit in
your workspace. Do NOT rely on internal assumptions. You must actively use your code access
tools to inspect the actual source code, callers, and surrounding context.

================================================================================
1. CORE TRIAGE PHILOSOPHY
================================================================================
The goal of patch fuzzing is to discover crashes, regressions, exposed latent bugs,
and newly triggered assertions introduced by the patch series.

- REACHABILITY IS THE PRIMARY GATE:
  Fuzzing can only discover bugs in code that can actually execute in standard virtualized
  environments (GCE or QEMU, utilizing software-emulated devices like USB gadgets, netdev, tun/tap).
  If the modified code is structurally unreachable (see Section 2), it MUST NOT be fuzzed,
  regardless of whether it adds assertions or complex logic.

- DO NOT BLINDLY TRUST "NO FUNCTIONAL CHANGE" (NFCI) OR "REFACTORING" CLAIMS:
  Patch authors routinely label changes as "cleanups", "refactorings", or state
  "No functional change intended". Do NOT take these claims at face value.
  Code refactorings that rearrange logic, introduce helper functions, or alter state management
  in core subsystems frequently introduce subtle semantic shifts or uncover latent kernel bugs.
  If reachable executable code is modified or refactored, it MUST be fuzzed.

- NEW OR MODIFIED ASSERTIONS IN REACHABLE CODE MUST BE FUZZED:
  When a patch introduces or modifies runtime checks or assertions (e.g., WARN_ON*, VM_WARN_ON*,
  BUG_ON*, lockdep_assert*) in reachable code paths, it enforces new or stricter invariants.
  Even if the author believes the invariant always holds, fuzzing is essential to verify whether
  an unusual sequence of operations can violate it.

================================================================================
2. WHEN TO RETURN WorthFuzzing=false (NEGATIVE CRITERIA)
================================================================================
Return WorthFuzzing=false ONLY IF all modified code falls strictly into one or more of these categories:

- Non-kernel and non-executable changes:
  * Modifications to Documentation/, comments, or spelling fixes.
  * User-space directories, self-tests, samples, or scripts (e.g., tools/, samples/, scripts/, usr/)
    that do not affect the compiled kernel image (vmlinux) or kernel modules.
  * Purely decorative logging (e.g., message strings in pr_err, printk, dev_info) or tracepoints
    that do not alter control flow or data structures.
  * Build system or Kconfig changes that do not alter compiled C logic.
- Structurally unreachable hardware:
  * Vendor-specific PCIe switches, SmartNICs, or GPU drivers (e.g., mlxsw, pds_core, qed,
    ionic, amdgpu) requiring physical ASIC/PCIe cards not emulated in standard QEMU.
- Unreachable execution paths:
  * Driver teardown callbacks (.remove, .shutdown, pci_unregister_driver) executed only during
    physical PCI hot-unplug or manual sysfs driver unbinding.
  * Code paths exclusive to architectures other than the target architecture.

================================================================================
3. WHEN TO RETURN WorthFuzzing=true (POSITIVE CRITERIA)
================================================================================
Return WorthFuzzing=true whenever the patch touches reachable executable code, including:
- Core Subsystems:
  * Any logic modifications in memory management (mm/), synchronization/locking (kernel/locking/),
    BPF, scheduler, core networking, VFS, or syscall handling.
- Refactorings and Code Cleanups:
  * Any restructuring of reachable data structures, helper abstractions, or algorithm flows.
- Runtime Assertions and Defensive Checks:
  * Any introduction or alteration of assertions (WARN_ON*, VM_WARN_ON*, BUG_ON*, etc.) in reachable paths.
- Reachable Drivers and Protocols:
  * Drivers accessible via virtual buses (virtio, USB gadget, loopback, netlink, binder, sockets, etc.).

================================================================================
4. EXTRACTING FocusSymbols (PREVENTING DILUTION)
================================================================================
When WorthFuzzing=true, you must extract specific kernel functions into FocusSymbols to guide the fuzzer:

- AVOID UBIQUITOUS LIFECYCLE HOT-PATHS:
  Do NOT list generic, ubiquitous functions called by almost every program in the corpus
  (including, but not limited to: general memory allocators and deallocators, page fault
  and trap handlers, or core synchronization primitives; this is not an exhaustive list).
  Listing ubiquitous functions causes the fuzzer to classify thousands of unrelated tests as "focused",
  which severely dilutes fuzzing effort away from the actual changes.

- TARGET SPECIFIC FEATURE LOGIC AND ENTRYPOINTS:
  List functions that specifically implement the logic being added or altered, or direct API entrypoints
  for the subsystem feature under review.

- HANDLING STATIC INLINE FUNCTIONS IN HEADERS (.h):
  Compiler-inlined static functions (such as static inlines in mm/*.h or include/linux/*.h) lack
  distinct symbol addresses in vmlinux and cannot be targeted directly by symbol coverage filters.
  If the changes are primarily in static inline helpers, identify non-static, feature-specific caller
  functions in .c files that exercise them (avoiding ubiquitous lifecycle wrappers).

================================================================================
5. IDENTIFYING EnableConfigs
================================================================================
Identify any specific CONFIG_ options required to properly compile and reach the modified code:
- Inspect Kconfig files and #ifdef guards; do not make assumptions.
- Check "depends on" lines in Kconfig to include any non-standard parent subsystem configs needed.
- Strip any 'CONFIG_' prefix (e.g., return "NET_IPV4" instead of "CONFIG_NET_IPV4").
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 18:13:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8f5a5e1342a95..21a1922bee4fb 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
 			clear_bit(Faulty, &r->flags);
 			clear_bit(WriteErrorSeen, &r->flags);
 
-			if (mddev->pers->hot_add_disk(mddev, r)) {
+			if (mddev->pers->hot_add_disk(mddev, r, NULL)) {
 				/* Failed to revive this device, try next */
 				r->raid_disk = r->saved_raid_disk = -1;
 				r->flags = flags;
diff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c
index 4b80165afd233..929513109657f 100644
--- a/drivers/md/md-autodetect.c
+++ b/drivers/md/md-autodetect.c
@@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args *args)
 				(1 << MD_DISK_ACTIVE) | (1 << MD_DISK_SYNC);
 		}
 
-		md_add_new_disk(mddev, &dinfo);
+		md_add_new_disk(mddev, &dinfo, NULL);
 	}
 
 	if (!err)
diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c
index 73b367b61b873..1f44c2d7db93d 100644
--- a/drivers/md/md-linear.c
+++ b/drivers/md/md-linear.c
@@ -186,7 +186,8 @@ static int linear_run(struct mddev *mddev)
 	return ret;
 }
 
-static int linear_add(struct mddev *mddev, struct md_rdev *rdev)
+static int linear_add(struct mddev *mddev, struct md_rdev *rdev,
+		      struct queue_limits *lim)
 {
 	/* Adding a drive to a linear array allows the array to grow.
 	 * It is permitted if the new drive has a matching superblock
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3d..c4054d06d1070 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
  */
 static struct workqueue_struct *md_misc_wq;
 
-static int remove_and_add_spares(struct mddev *mddev,
-				 struct md_rdev *this);
+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,
+				 struct queue_limits *lim);
 static void mddev_detach(struct mddev *mddev);
 static void export_rdev(struct md_rdev *rdev);
 static void md_wakeup_thread_directly(struct md_thread __rcu **thread);
@@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev *mddev, int force_change)
 }
 EXPORT_SYMBOL(md_update_sb);
 
-static int add_bound_rdev(struct md_rdev *rdev)
+static int add_bound_rdev(struct md_rdev *rdev, struct queue_limits *lim)
 {
 	struct mddev *mddev = rdev->mddev;
 	int err = 0;
@@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev *rdev)
 		 */
 		super_types[mddev->major_version].
 			validate_super(mddev, NULL/*freshest*/, rdev);
-		err = mddev->pers->hot_add_disk(mddev, rdev);
+		err = mddev->pers->hot_add_disk(mddev, rdev, lim);
 		if (err) {
 			md_kick_rdev_from_array(rdev);
 			return err;
@@ -3033,7 +3033,13 @@ static int cmd_match(const char *cmd, const char *str)
 struct rdev_sysfs_entry {
 	struct attribute attr;
 	ssize_t (*show)(struct md_rdev *, char *);
-	ssize_t (*store)(struct md_rdev *, const char *, size_t);
+	/*
+	 * @lim: a queue limits update the caller owns, or NULL.  Stores that
+	 * can add a leg to the array must stack into it rather than take
+	 * q->limits_lock themselves, see md_start_sync().
+	 */
+	ssize_t (*store)(struct md_rdev *rdev, const char *page, size_t len,
+			 struct queue_limits *lim);
 };
 
 static ssize_t
@@ -3079,7 +3085,8 @@ state_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-state_store(struct md_rdev *rdev, const char *buf, size_t len)
+state_store(struct md_rdev *rdev, const char *buf, size_t len,
+	    struct queue_limits *lim)
 {
 	/* can write
 	 *  faulty  - simulates an error
@@ -3110,7 +3117,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 	} else if (cmd_match(buf, "remove")) {
 		if (rdev->mddev->pers) {
 			clear_bit(Blocked, &rdev->flags);
-			remove_and_add_spares(rdev->mddev, rdev);
+			remove_and_add_spares(rdev->mddev, rdev, lim);
 		}
 		if (rdev->raid_disk >= 0)
 			err = -EBUSY;
@@ -3229,7 +3236,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 			if (!mddev_is_clustered(rdev->mddev) ||
 			    (err = mddev->cluster_ops->gather_bitmaps(rdev)) == 0) {
 				clear_bit(Faulty, &rdev->flags);
-				err = add_bound_rdev(rdev);
+				err = add_bound_rdev(rdev, lim);
 			}
 		} else
 			err = -EBUSY;
@@ -3257,7 +3264,8 @@ errors_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-errors_store(struct md_rdev *rdev, const char *buf, size_t len)
+errors_store(struct md_rdev *rdev, const char *buf, size_t len,
+	     struct queue_limits *lim)
 {
 	unsigned int n;
 	int rv;
@@ -3283,7 +3291,8 @@ slot_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-slot_store(struct md_rdev *rdev, const char *buf, size_t len)
+slot_store(struct md_rdev *rdev, const char *buf, size_t len,
+	   struct queue_limits *lim)
 {
 	int slot;
 	int err;
@@ -3314,7 +3323,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
 		if (rdev->mddev->pers->hot_remove_disk == NULL)
 			return -EINVAL;
 		clear_bit(Blocked, &rdev->flags);
-		remove_and_add_spares(rdev->mddev, rdev);
+		remove_and_add_spares(rdev->mddev, rdev, lim);
 		if (rdev->raid_disk >= 0)
 			return -EBUSY;
 		set_bit(MD_RECOVERY_NEEDED, &rdev->mddev->recovery);
@@ -3344,7 +3353,8 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
 			rdev->saved_raid_disk = -1;
 		clear_bit(In_sync, &rdev->flags);
 		clear_bit(Bitmap_sync, &rdev->flags);
-		err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev);
+		err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev,
+						     lim);
 		if (err) {
 			rdev->raid_disk = -1;
 			return err;
@@ -3377,7 +3387,8 @@ offset_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-offset_store(struct md_rdev *rdev, const char *buf, size_t len)
+offset_store(struct md_rdev *rdev, const char *buf, size_t len,
+	     struct queue_limits *lim)
 {
 	unsigned long long offset;
 	if (kstrtoull(buf, 10, &offset) < 0)
@@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t new_offset_store(struct md_rdev *rdev,
-				const char *buf, size_t len)
+				const char *buf, size_t len,
+				struct queue_limits *lim)
 {
 	unsigned long long new_offset;
 	struct mddev *mddev = rdev->mddev;
@@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char *buf, sector_t *sectors)
 }
 
 static ssize_t
-rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len,
+		struct queue_limits *lim)
 {
 	struct mddev *my_mddev = rdev->mddev;
 	sector_t oldsectors = rdev->sectors;
@@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev *rdev, char *page)
 	return sprintf(page, "%llu\n", recovery_start);
 }
 
-static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len)
+static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len,
+				    struct queue_limits *lim)
 {
 	unsigned long long recovery_start;
 
@@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev *rdev, char *page)
 {
 	return badblocks_show(&rdev->badblocks, page, 0);
 }
-static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len)
+
+static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len,
+			struct queue_limits *lim)
 {
 	int rv = badblocks_store(&rdev->badblocks, page, len, 0);
 	/* Maybe that ack was all we needed */
@@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev *rdev, char *page)
 {
 	return badblocks_show(&rdev->badblocks, page, 1);
 }
-static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len)
+
+static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len,
+			 struct queue_limits *lim)
 {
 	return badblocks_store(&rdev->badblocks, page, len, 1);
 }
@@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len)
+ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len,
+		 struct queue_limits *lim)
 {
 	unsigned long long sector;
 
@@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len,
+	       struct queue_limits *lim)
 {
 	unsigned int size;
 
@@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 	struct rdev_sysfs_entry *entry = container_of(attr, struct rdev_sysfs_entry, attr);
 	struct md_rdev *rdev = container_of(kobj, struct md_rdev, kobj);
 	struct kernfs_node *kn = NULL;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	bool suspend = false;
 	ssize_t rv;
 	struct mddev *mddev = READ_ONCE(rdev->mddev);
@@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 			suspend = true;
 	}
 
+	/*
+	 * These can add a leg back, which stacks its limits; the other
+	 * state_store() values never reach ->hot_add_disk().  q->limits_lock
+	 * nests outside the lock and the suspend, see md_start_sync().
+	 */
+	if ((entry->store == slot_store ||
+	     (entry->store == state_store &&
+	      (cmd_match(page, "remove") || cmd_match(page, "re-add")))) &&
+	    !mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	rv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);
 	if (!rv) {
 		if (rdev->mddev == NULL)
 			rv = -ENODEV;
 		else
-			rv = entry->store(rdev, page, length);
+			rv = entry->store(rdev, page, length, limp);
+		/* apply the limits before the array takes I/O again */
+		if (limp) {
+			queue_limits_commit_update(q, limp);
+			limp = NULL;
+		}
 		suspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev);
 	}
 
+	if (limp)
+		queue_limits_commit_update(q, limp);
+
 	if (kn)
 		sysfs_unbreak_active_protection(kn);
 
@@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev)
 }
 EXPORT_SYMBOL_GPL(mddev_stack_new_rdev);
 
+/*
+ * Stack a new rdev into limits the caller already holds limits_lock for and
+ * will commit itself.  Used from paths that must take limits_lock before
+ * quiescing the array, see md_start_sync().
+ */
+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
+{
+	struct queue_limits tmp = *lim;
+
+	if (mddev_is_dm(mddev))
+		return 0;
+
+	if (queue_logical_block_size(rdev->bdev->bd_disk->queue) >
+	    queue_logical_block_size(mddev->gendisk->queue)) {
+		pr_err("%s: incompatible logical_block_size, can not add\n",
+		       mdname(mddev));
+		return -EINVAL;
+	}
+
+	queue_limits_stack_bdev(&tmp, rdev->bdev, rdev->data_offset,
+				mddev->gendisk->disk_name);
+
+	if (!queue_limits_stack_integrity_bdev(&tmp, rdev->bdev)) {
+		pr_err("%s: incompatible integrity profile for %pg\n",
+		       mdname(mddev), rdev->bdev);
+		return -ENXIO;
+	}
+
+	*lim = tmp;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_stack_rdev_into);
+
+/* for callers that must not wait for q->limits_lock, see md_start_sync() */
+static bool mddev_stack_limits_trylock(struct mddev *mddev,
+				       struct queue_limits *lim)
+{
+	struct request_queue *q;
+
+	if (mddev_is_dm(mddev))
+		return false;
+
+	q = mddev->gendisk->queue;
+
+	return queue_limits_start_update_trylock(q, lim);
+}
+
 /* update the optimal I/O size after a reshape */
-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes)
+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,
+			 struct queue_limits *lim)
 {
-	struct queue_limits lim;
+	struct queue_limits own;
 
 	if (mddev_is_dm(mddev))
 		return;
 
+	/*
+	 * With an update owned by the caller just change it in place; it is
+	 * committed, and the array resumed, by whoever started it.  Taking
+	 * q->limits_lock here would nest it inside reconfig_mutex and the
+	 * suspend, which deadlocks, see md_start_sync().
+	 */
+	if (lim) {
+		lim->io_opt = lim->io_min * nr_stripes;
+		return;
+	}
+
+	/*
+	 * Called from the sync thread, which md_reap_sync_thread() waits for
+	 * with reconfig_mutex held, so don't wait for q->limits_lock here.
+	 * io_opt is a hint, skipping it on a contended pass is fine.
+	 */
+	if (!mddev_stack_limits_trylock(mddev, &own))
+		return;
+
 	/* don't bother updating io_opt if we can't suspend the array */
-	if (mddev_suspend(mddev, false) < 0)
+	if (mddev_suspend(mddev, false) < 0) {
+		queue_limits_cancel_update(mddev->gendisk->queue);
 		return;
-	lim = queue_limits_start_update(mddev->gendisk->queue);
-	lim.io_opt = lim.io_min * nr_stripes;
-	queue_limits_commit_update(mddev->gendisk->queue, &lim);
+	}
+	own.io_opt = own.io_min * nr_stripes;
+	queue_limits_commit_update(mddev->gendisk->queue, &own);
 	mddev_resume(mddev);
 }
 EXPORT_SYMBOL_GPL(mddev_update_io_opt);
@@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev *mddev, void __user * arg)
 	return 0;
 }
 
-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,
+		    struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 	dev_t dev = MKDEV(info->major,info->minor);
@@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
 				if (err)
 					mddev->cluster_ops->add_new_disk_cancel(mddev);
 				else
-					err = add_bound_rdev(rdev);
+					err = add_bound_rdev(rdev, lim);
 			}
 
 		} else if (!err)
-			err = add_bound_rdev(rdev);
+			err = add_bound_rdev(rdev, lim);
 
 		return err;
 	}
@@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
 	return 0;
 }
 
-static int hot_remove_disk(struct mddev *mddev, dev_t dev)
+static int hot_remove_disk(struct mddev *mddev, dev_t dev,
+			   struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 
@@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev)
 		goto kick_rdev;
 
 	clear_bit(Blocked, &rdev->flags);
-	remove_and_add_spares(mddev, rdev);
+	remove_and_add_spares(mddev, rdev, lim);
 
 	if (rdev->raid_disk >= 0)
 		goto busy;
@@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd)
 	}
 }
 
+/*
+ * Commands that can reach ->hot_add_disk().  ADD_NEW_DISK only does so for a
+ * journal device or a personality without ->hot_remove_disk, but that depends
+ * on disk info still in user memory here, so it is included as a whole.
+ */
+static bool md_ioctl_may_add_disk(unsigned int cmd)
+{
+	switch (cmd) {
+	case ADD_NEW_DISK:
+	case HOT_REMOVE_DISK:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static bool md_ioctl_need_suspend(unsigned int cmd)
 {
 	switch (cmd) {
@@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	unsigned int noio_flags = 0;
 	void __user *argp = (void __user *)arg;
 	struct mddev *mddev = NULL;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	bool suspend;
 
 	err = md_ioctl_valid(cmd);
@@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	if (!md_is_rdwr(mddev))
 		flush_work(&mddev->sync_work);
 
+	/* q->limits_lock nests outside both, see md_start_sync() */
+	if (md_ioctl_may_add_disk(cmd) && !mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	suspend = md_ioctl_need_suspend(cmd);
 	err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);
 	if (err) {
 		pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n",
 			 err, cmd);
+		if (limp)
+			queue_limits_cancel_update(q);
 		goto out;
 	}
 	if (suspend)
@@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 		goto unlock;
 
 	case HOT_REMOVE_DISK:
-		err = hot_remove_disk(mddev, new_decode_dev(arg));
+		err = hot_remove_disk(mddev, new_decode_dev(arg), limp);
 		goto unlock;
 
 	case ADD_NEW_DISK:
@@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 				/* Need to clear read-only for this */
 				break;
 			else
-				err = md_add_new_disk(mddev, &info);
+				err = md_add_new_disk(mddev, &info, limp);
 			goto unlock;
 		}
 		break;
@@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 		if (copy_from_user(&info, argp, sizeof(info)))
 			err = -EFAULT;
 		else
-			err = md_add_new_disk(mddev, &info);
+			err = md_add_new_disk(mddev, &info, limp);
 		goto unlock;
 	}
 
@@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	    err != -EINVAL)
 		mddev->hold_active = 0;
 
+	if (limp)
+		queue_limits_commit_update(q, limp);
+
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		mddev_unlock_and_resume(mddev);
@@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev *mddev, struct md_rdev *this)
 	return removed;
 }
 
-static int remove_and_add_spares(struct mddev *mddev,
-				 struct md_rdev *this)
+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,
+				 struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 	int spares = 0;
@@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev *mddev,
 			continue;
 		if (!test_bit(Journal, &rdev->flags))
 			rdev->recovery_offset = 0;
-		if (mddev->pers->hot_add_disk(mddev, rdev) == 0) {
+		if (mddev->pers->hot_add_disk(mddev, rdev, lim) == 0) {
 			/* failure here is OK */
 			sysfs_link_rdev(mddev, rdev);
 			if (!test_bit(Journal, &rdev->flags))
@@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev *mddev,
 	return spares;
 }
 
-static bool md_choose_sync_action(struct mddev *mddev, int *spares)
+static bool md_choose_sync_action(struct mddev *mddev, int *spares,
+				  struct queue_limits *lim)
 {
 	/* Check if reshape is in progress first. */
 	if (mddev->reshape_position != MaxSector) {
@@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
 	 * also removed and re-added, to allow the personality to fail the
 	 * re-add.
 	 */
-	*spares = remove_and_add_spares(mddev, NULL);
+	*spares = remove_and_add_spares(mddev, NULL, lim);
 	if (*spares || test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery)) {
 		clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
 		clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
@@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
 static void md_start_sync(struct work_struct *ws)
 {
 	struct mddev *mddev = container_of(ws, struct mddev, sync_work);
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	int spares = 0;
 	bool suspend = false;
 	unsigned int noio_flags = 0;
@@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct *ws)
 	 */
 	if ((mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
 	    md_spares_need_change(mddev)) {
+		/*
+		 * Adding a spare below stacks its limits, which needs
+		 * q->limits_lock.  Take it before suspending: its holder
+		 * waits in blk_mq_freeze_queue() for I/O that
+		 * mddev->suspended holds back, so the other order deadlocks.
+		 */
+		if (!mddev_is_dm(mddev)) {
+			q = mddev->gendisk->queue;
+			lim = queue_limits_start_update(q);
+			limp = &lim;
+		}
 		suspend = true;
 		mddev_suspend(mddev, false);
 		noio_flags = memalloc_noio_save();
@@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct *ws)
 	if (!suspend && (mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
 	    md_spares_need_change(mddev)) {
 		mddev_unlock(mddev);
+		/* see above: q->limits_lock nests outside both */
+		if (!mddev_is_dm(mddev)) {
+			q = mddev->gendisk->queue;
+			lim = queue_limits_start_update(q);
+			limp = &lim;
+		}
 		mddev_suspend_and_lock_nointr(mddev);
 		suspend = true;
 		noio_flags = memalloc_noio_save();
@@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct *ws)
 		 * As we only add devices that are already in-sync, we can
 		 * activate the spares immediately.
 		 */
-		remove_and_add_spares(mddev, NULL);
+		remove_and_add_spares(mddev, NULL, limp);
 		goto not_running;
 	}
 
-	if (!md_choose_sync_action(mddev, &spares))
+	if (!md_choose_sync_action(mddev, &spares, limp))
 		goto not_running;
 
 	if (!mddev->pers->sync_request)
@@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct *ws)
 	 *     https://bugzilla.kernel.org/show_bug.cgi?id=218200
 	 * Therefore, use __mddev_resume(mddev, false).
 	 */
+	if (limp)
+		queue_limits_commit_update(q, limp);
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		__mddev_resume(mddev, false);
@@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct *ws)
 	 *     https://bugzilla.kernel.org/show_bug.cgi?id=218200
 	 * Therefore, use __mddev_resume(mddev, false).
 	 */
+	if (limp)
+		queue_limits_commit_update(q, limp);
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		__mddev_resume(mddev, false);
@@ -10793,6 +10965,7 @@ static int __init md_init(void)
 
 static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
 {
+	struct queue_limits lim;
 	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
 	struct md_rdev *rdev2, *tmp;
 	int role, ret;
@@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
 					rdev2->saved_raid_disk = -1;
 				else
 					rdev2->saved_raid_disk = role;
-				ret = remove_and_add_spares(mddev, rdev2);
+				/*
+				 * reconfig_mutex is held, so don't wait for
+				 * q->limits_lock; MD_RECOVERY_NEEDED below
+				 * leaves a skipped add to md_start_sync().
+				 */
+				if (mddev_stack_limits_trylock(mddev, &lim)) {
+					struct request_queue *q =
+						mddev->gendisk->queue;
+
+					ret = remove_and_add_spares(mddev,
+								    rdev2, &lim);
+					queue_limits_commit_update(q, &lim);
+				} else if (mddev_is_dm(mddev)) {
+					ret = remove_and_add_spares(mddev,
+								    rdev2, NULL);
+				} else {
+					ret = remove_spares(mddev, rdev2);
+				}
 				pr_info("Activated spare: %pg\n",
 					rdev2->bdev);
 				/* wakeup mddev->thread here, so array could
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b6d2e8929a0f9..ceca8cfcdcb9e 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -765,7 +765,8 @@ struct md_personality
 	 * if appropriate, and should abort recovery if needed
 	 */
 	void (*error_handler)(struct mddev *mddev, struct md_rdev *rdev);
-	int (*hot_add_disk) (struct mddev *mddev, struct md_rdev *rdev);
+	int (*hot_add_disk)(struct mddev *mddev, struct md_rdev *rdev,
+			    struct queue_limits *lim);
 	int (*hot_remove_disk) (struct mddev *mddev, struct md_rdev *rdev);
 	int (*spare_active) (struct mddev *mddev);
 	sector_t (*sync_request)(struct mddev *mddev, sector_t sector_nr,
@@ -1041,13 +1042,17 @@ struct mdu_disk_info_s;
 extern int mdp_major;
 void md_autostart_arrays(int part);
 int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info);
-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info);
+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,
+		    struct queue_limits *lim);
 int do_md_run(struct mddev *mddev);
 #define MDDEV_STACK_INTEGRITY	(1u << 0)
 int mddev_stack_rdev_limits(struct mddev *mddev, struct queue_limits *lim,
 		unsigned int flags);
 int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev);
-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes);
+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim);
+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,
+			 struct queue_limits *lim);
 
 extern const struct block_device_operations md_fops;
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371f..dd348b5695d06 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf *conf, int disk)
 	return true;
 }
 
-static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
 {
 	struct r1conf *conf = mddev->private;
 	int err = -EEXIST;
@@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 	for (mirror = first; mirror <= last; mirror++) {
 		p = conf->mirrors + mirror;
 		if (!p->rdev) {
-			err = mddev_stack_new_rdev(mddev, rdev);
+			if (lim)
+				err = mddev_stack_rdev_into(mddev, rdev, lim);
+			else
+				err = mddev_stack_new_rdev(mddev, rdev);
 			if (err)
 				return err;
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1093c798d9dde..641619328a6c4 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev *mddev)
 	return count;
 }
 
-static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			   struct queue_limits *lim)
 {
 	struct r10conf *conf = mddev->private;
 	int err = -EEXIST;
@@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 			continue;
 		}
 
-		err = mddev_stack_new_rdev(mddev, rdev);
+		if (lim)
+			err = mddev_stack_rdev_into(mddev, rdev, lim);
+		else
+			err = mddev_stack_new_rdev(mddev, rdev);
 		if (err)
 			return err;
 		p->head_position = 0;
@@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 		clear_bit(In_sync, &rdev->flags);
 		set_bit(Replacement, &rdev->flags);
 		rdev->raid_disk = repl_slot;
-		err = mddev_stack_new_rdev(mddev, rdev);
+		if (lim)
+			err = mddev_stack_rdev_into(mddev, rdev, lim);
+		else
+			err = mddev_stack_new_rdev(mddev, rdev);
 		if (err)
 			return err;
 		conf->fullsync = 1;
@@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev *mddev)
 		rdev_for_each(rdev, mddev)
 			if (rdev->raid_disk < 0 &&
 			    !test_bit(Faulty, &rdev->flags)) {
-				if (raid10_add_disk(mddev, rdev) == 0) {
+				if (raid10_add_disk(mddev, rdev, NULL) == 0) {
 					if (rdev->raid_disk >=
 					    conf->prev.raid_disks)
 						set_bit(In_sync, &rdev->flags);
@@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf *conf)
 	conf->reshape_safe = MaxSector;
 	spin_unlock_irq(&conf->device_lock);
 
-	mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf));
+	mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf), NULL);
 	conf->fullsync = 0;
 }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b91545ce090de..22759c631c4d9 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7288,6 +7288,9 @@ static ssize_t
 raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)
 {
 	struct r5conf *conf;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	unsigned long new;
 	int err;
 
@@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)
 		return -EINVAL;
 	new = !!new;
 
+	/* q->limits_lock nests outside both, see md_start_sync() */
+	if (!mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	err = mddev_suspend_and_lock(mddev);
-	if (err)
+	if (err) {
+		if (limp)
+			queue_limits_cancel_update(q);
 		return err;
+	}
 	conf = mddev->private;
 	if (!conf)
 		err = -ENODEV;
 	else if (new != conf->skip_copy) {
-		struct request_queue *q = mddev->gendisk->queue;
-		struct queue_limits lim = queue_limits_start_update(q);
-
 		conf->skip_copy = new;
-		if (new)
-			lim.features |= BLK_FEAT_STABLE_WRITES;
-		else
-			lim.features &= ~BLK_FEAT_STABLE_WRITES;
-		err = queue_limits_commit_update(q, &lim);
+		if (limp) {
+			if (new)
+				limp->features |= BLK_FEAT_STABLE_WRITES;
+			else
+				limp->features &= ~BLK_FEAT_STABLE_WRITES;
+		}
 	}
+	if (limp)
+		err = queue_limits_commit_update(q, limp) ?: err;
 	mddev_unlock_and_resume(mddev);
 	return err ?: len;
 }
@@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
 	return err;
 }
 
-static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
 {
 	struct r5conf *conf = mddev->private;
 	int ret, err = -EEXIST;
@@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev *mddev)
 		rdev_for_each(rdev, mddev)
 			if (rdev->raid_disk < 0 &&
 			    !test_bit(Faulty, &rdev->flags)) {
-				if (raid5_add_disk(mddev, rdev) == 0) {
+				if (raid5_add_disk(mddev, rdev, NULL) == 0) {
 					if (rdev->raid_disk
 					    >= conf->previous_raid_disks)
 						set_bit(In_sync, &rdev->flags);
@@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf *conf)
 		wake_up(&conf->wait_for_reshape);
 
 		mddev_update_io_opt(conf->mddev,
-			conf->raid_disks - conf->max_degraded);
+			conf->raid_disks - conf->max_degraded, NULL);
 	}
 }
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f7905c3412b8..b75e85291e290 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue *q)
 	mutex_lock(&q->limits_lock);
 	return q->limits;
 }
+
+/**
+ * queue_limits_start_update_trylock - try to start an atomic update of queue
+ *	limits
+ * @q:		queue to update
+ * @lim:	returns a snapshot of the current limits on success
+ *
+ * Like queue_limits_start_update(), but fails instead of waiting when another
+ * update is in flight.  For callers that must not block on q->limits_lock
+ * because they hold something its current owner is waiting for.
+ *
+ * Context: process context.
+ */
+static inline bool
+queue_limits_start_update_trylock(struct request_queue *q,
+				  struct queue_limits *lim)
+	__cond_acquires(true, &q->limits_lock)
+{
+	if (!mutex_trylock(&q->limits_lock))
+		return false;
+
+	*lim = q->limits;
+
+	return true;
+}
+
 int queue_limits_commit_update_frozen(struct request_queue *q,
 		struct queue_limits *lim) __releases(&q->limits_lock);
 int queue_limits_commit_update(struct request_queue *q,

							input: 15365
							output: 31
							thoughts: 725

**Analyzing the MD RAID Patch for Fuzzing Potential**

Okay, let's break down this patch. My immediate thought is to determine if it's fuzz-worthy, what kind of configuration is needed, and if we can identify specific symbols to focus our fuzzing efforts on.

First, I need to understand what this patch actually *does*. It looks like it's all about resolving lock ordering issues and potential deadlocks within the MD (Multiple Devices/software RAID) subsystem, specifically around those locks: `q->limits_lock`, `reconfig_mutex`, and `mddev_suspend()`. The code touches a lot of files within `drivers/md/`, so it's a pretty central area.

It looks like the patch is adding this new `queue_limits_start_update_trylock` function. The patch then seems to be propagating changes throughout the MD subsystem, modifying function signatures and updating lock acquisition strategies. Specifically:

* It updates calls related to adding disks (`hot_add_disk`, `md_add_new_disk`) and adjusting queue limits in the `dm-raid.c`, `md-autodetect.c`, and `md-linear.c` files.
* The `md.c` file sees the most changes, including a new `queue_limits` parameter being added to the rdev sysfs entry `store` method. This also involves changes to how locks are acquired in `rdev_attr_store()`, adding new functions like `mddev_stack_rdev_into()` and `mddev_stack_limits_trylock()`, and updates to `mddev_update_io_opt()` and other core MD functions (`md_add_new_disk()`, `hot_remove_disk()`, `remove_and_add_spares()`, etc.).
* It's also updating functions across several RAID implementations (`raid1.c`, `raid10.c`, `raid5.c`) to handle this `queue_limits` struct.

Alright, that's the code. Now I need to consider reachability. MD RAID, being a core part of storage management, should be pretty easily reachable, especially in a fuzzing context. From what I know, it's accessible through ioctls on `/dev/md*`, and sysfs entries under `/sys/block/mdX/md/...`. Syzkaller should already have good coverage for these interfaces. If so, that greatly increases the likelihood of finding bugs.

Lastly, I need to check the Kconfig requirements. I'll need to confirm that MD RAID and its sub-components are enabled to trigger these updated code paths. Time to grep for the relevant `CONFIG_MD*` and `CONFIG_BLK_DEV_MD*` options in the Kconfig files. This will tell me which configurations I need to set for a good fuzzing run.

{
  "Expression": "config BLK_DEV_MD",
  "PathPrefix": "drivers/md/"
}

{
  "Output": "drivers/md/Kconfig=13=if MD\ndrivers/md/Kconfig-14-\ndrivers/md/Kconfig:15:config BLK_DEV_MD\ndrivers/md/Kconfig-16-\ttristate \"RAID support\"\n"
}

							input: 16813
							output: 32
							thoughts: 27

Here's my take on those thoughts:

**Investigating the MD Configuration Landscape**

Okay, so I need to get a handle on the MD (Multiple Device) configuration options within this kernel build. My initial thought is to zero in on `drivers/md/Kconfig`. That's where all the relevant Kconfig options and their dependencies are defined, naturally. I figure the first 50 lines or so should give me a good overview of the core MD settings. I'm hoping to quickly identify the key variables and any critical dependencies that might affect how MD is configured, and what the base-level choices are for RAID, LVM, and any other relevant block device management components. It's a quick way to get context and see how things are structured before digging deeper.

{
  "File": "drivers/md/Kconfig",
  "FirstLine": 1,
  "LineCount": 70
}

{
  "Contents": "   1:\t# SPDX-License-Identifier: GPL-2.0-only\n   2:\t#\n   3:\t# Block device driver configuration\n   4:\t#\n   5:\t\n   6:\tmenuconfig MD\n   7:\t\tbool \"Multiple devices driver support (RAID and LVM)\"\n   8:\t\tdepends on BLOCK\n   9:\t\thelp\n  10:\t\t  Support multiple physical spindles through a single logical device.\n  11:\t\t  Required for RAID and logical volume management.\n  12:\t\n  13:\tif MD\n  14:\t\n  15:\tconfig BLK_DEV_MD\n  16:\t\ttristate \"RAID support\"\n  17:\t\tselect BLOCK_HOLDER_DEPRECATED if SYSFS\n  18:\t\tselect BUFFER_HEAD\n  19:\t\t# BLOCK_LEGACY_AUTOLOAD requirement should be removed\n  20:\t\t# after relevant mdadm enhancements - to make \"names=yes\"\n  21:\t\t# the default - are widely available.\n  22:\t\tselect BLOCK_LEGACY_AUTOLOAD\n  23:\t\thelp\n  24:\t\t  This driver lets you combine several hard disk partitions into one\n  25:\t\t  logical block device. This can be used to simply append one\n  26:\t\t  partition to another one or to combine several redundant hard disks\n  27:\t\t  into a RAID1/4/5 device so as to provide protection against hard\n  28:\t\t  disk failures. This is called \"Software RAID\" since the combining of\n  29:\t\t  the partitions is done by the kernel. \"Hardware RAID\" means that the\n  30:\t\t  combining is done by a dedicated controller; if you have such a\n  31:\t\t  controller, you do not need to say Y here.\n  32:\t\n  33:\t\t  More information about Software RAID on Linux is contained in the\n  34:\t\t  Software RAID mini-HOWTO, available from\n  35:\t\t  \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also learn\n  36:\t\t  where to get the supporting user space utilities raidtools.\n  37:\t\n  38:\t\t  If unsure, say N.\n  39:\t\n  40:\tconfig MD_BITMAP\n  41:\t\tbool \"MD RAID bitmap support\"\n  42:\t\tdefault y\n  43:\t\tdepends on BLK_DEV_MD\n  44:\t\thelp\n  45:\t\t  If you say Y here, support for the write intent bitmap will be\n  46:\t\t  enabled. The bitmap can be used to optimize resync speed after power\n  47:\t\t  failure or readding a disk, limiting it to recorded dirty sectors in\n  48:\t\t  bitmap.\n  49:\t\n  50:\t\t  This feature can be added to existing MD array or MD array can be\n  51:\t\t  created with bitmap via mdadm(8).\n  52:\t\n  53:\t\t  If unsure, say Y.\n  54:\t\n  55:\tconfig MD_LLBITMAP\n  56:\t\tbool \"MD RAID lockless bitmap support\"\n  57:\t\tdepends on BLK_DEV_MD\n  58:\t\thelp\n  59:\t\t  If you say Y here, support for the lockless write intent bitmap will\n  60:\t\t  be enabled.\n  61:\t\n  62:\t\t  Note, this is an experimental feature.\n  63:\t\n  64:\t\t  If unsure, say N.\n  65:\t\n  66:\tconfig MD_AUTODETECT\n  67:\t\tbool \"Autodetect RAID arrays during kernel boot\"\n  68:\t\tdepends on BLK_DEV_MD=y\n  69:\t\tdefault y\n  70:\t\thelp\n"
}

							input: 17966
							output: 33
							thoughts: 38

Okay, here's my take on those thoughts, tailored for an expert audience:

**Analyzing RAID Personality Configurations in `drivers/md/Kconfig`**

Alright, let's dive into the details. I need to make sure I haven't missed any edge cases or overlooked modifications. My primary focus is to examine the `drivers/md/Kconfig` file, specifically looking at the configurations related to RAID personalities that have been altered, specifically focusing on linear, raid1, raid10, and raid456/raid5. I need to ensure the modifications made are consistent across all affected RAID levels and that there are no unintended consequences in how these personalities are defined or enabled. I'll be meticulously checking dependencies, defaults, and any conditional logic to get a holistic view of the implications of the changes. This thorough analysis should help me identify and rectify any potential issues before they cause problems.

{
  "File": "drivers/md/Kconfig",
  "FirstLine": 71,
  "LineCount": 80
}

{
  "Contents": "  71:\t\t  If you say Y here, then the kernel will try to autodetect raid\n  72:\t\t  arrays as part of its boot process.\n  73:\t\n  74:\t\t  If you don't use raid and say Y, this autodetection can cause\n  75:\t\t  a several-second delay in the boot time due to various\n  76:\t\t  synchronisation steps that are part of this step.\n  77:\t\n  78:\t\t  If unsure, say Y.\n  79:\t\n  80:\tconfig MD_BITMAP_FILE\n  81:\t\tbool \"MD bitmap file support (deprecated)\"\n  82:\t\tdefault y\n  83:\t\tdepends on MD_BITMAP\n  84:\t\thelp\n  85:\t\t  If you say Y here, support for write intent bitmaps in files on an\n  86:\t\t  external file system is enabled.  This is an alternative to the internal\n  87:\t\t  bitmaps near the MD superblock, and very problematic code that abuses\n  88:\t\t  various kernel APIs and can only work with files on a file system not\n  89:\t\t  actually sitting on the MD device.\n  90:\t\n  91:\tconfig MD_LINEAR\n  92:\t\ttristate \"Linear (append) mode\"\n  93:\t\tdepends on BLK_DEV_MD\n  94:\t\thelp\n  95:\t\t  If you say Y here, then your multiple devices driver will be able to\n  96:\t\t  use the so-called linear mode, i.e. it will combine the hard disk\n  97:\t\t  partitions by simply appending one to the other.\n  98:\t\n  99:\t\t  To compile this as a module, choose M here: the module\n 100:\t\t  will be called linear.\n 101:\t\n 102:\t\t  If unsure, say Y.\n 103:\t\n 104:\tconfig MD_RAID0\n 105:\t\ttristate \"RAID-0 (striping) mode\"\n 106:\t\tdepends on BLK_DEV_MD\n 107:\t\thelp\n 108:\t\t  If you say Y here, then your multiple devices driver will be able to\n 109:\t\t  use the so-called raid0 mode, i.e. it will combine the hard disk\n 110:\t\t  partitions into one logical device in such a fashion as to fill them\n 111:\t\t  up evenly, one chunk here and one chunk there. This will increase\n 112:\t\t  the throughput rate if the partitions reside on distinct disks.\n 113:\t\n 114:\t\t  Information about Software RAID on Linux is contained in the\n 115:\t\t  Software-RAID mini-HOWTO, available from\n 116:\t\t  \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also\n 117:\t\t  learn where to get the supporting user space utilities raidtools.\n 118:\t\n 119:\t\t  To compile this as a module, choose M here: the module\n 120:\t\t  will be called raid0.\n 121:\t\n 122:\t\t  If unsure, say Y.\n 123:\t\n 124:\tconfig MD_RAID1\n 125:\t\ttristate \"RAID-1 (mirroring) mode\"\n 126:\t\tdepends on BLK_DEV_MD\n 127:\t\thelp\n 128:\t\t  A RAID-1 set consists of several disk drives which are exact copies\n 129:\t\t  of each other.  In the event of a mirror failure, the RAID driver\n 130:\t\t  will continue to use the operational mirrors in the set, providing\n 131:\t\t  an error free MD (multiple device) to the higher levels of the\n 132:\t\t  kernel.  In a set with N drives, the available space is the capacity\n 133:\t\t  of a single drive, and the set protects against a failure of (N - 1)\n 134:\t\t  drives.\n 135:\t\n 136:\t\t  Information about Software RAID on Linux is contained in the\n 137:\t\t  Software-RAID mini-HOWTO, available from\n 138:\t\t  \u003chttps://www.tldp.org/docs.html#howto\u003e.  There you will also\n 139:\t\t  learn where to get the supporting user space utilities raidtools.\n 140:\t\n 141:\t\t  If you want to use such a RAID-1 set, say Y.  To compile this code\n 142:\t\t  as a module, choose M here: the module will be called raid1.\n 143:\t\n 144:\t\t  If unsure, say Y.\n 145:\t\n 146:\tconfig MD_RAID10\n 147:\t\ttristate \"RAID-10 (mirrored striping) mode\"\n 148:\t\tdepends on BLK_DEV_MD\n 149:\t\thelp\n 150:\t\t  RAID-10 provides a combination of striping (RAID-0) and\n"
}

							input: 19506
							output: 34
							thoughts: 15

Okay, here's the summary, rendered as if I'm the one thinking it:

**Considering RAID Options**

Alright, I've been focusing primarily on the more common RAID configurations, but it's crucial to be thorough. Let's not overlook some of the less-used but potentially relevant options. Time to expand my mental checklist. I need to make sure I haven't missed anything, especially in specific use cases where these alternatives might be ideal. My initial considerations covered the workhorses, but a deeper dive is necessary. Specifically, let's also give a thorough once-over to RAID 4, 5, and 6 – revisiting their strengths, weaknesses, and potential applicability. I should also refresh my understanding of DM-RAID's capabilities and its place in this landscape. A comprehensive view requires this more granular analysis.

{
  "File": "drivers/md/Kconfig",
  "FirstLine": 151,
  "LineCount": 70
}

{
  "Contents": " 151:\t\t  mirroring (RAID-1) with easier configuration and more flexible\n 152:\t\t  layout.\n 153:\t\t  Unlike RAID-0, but like RAID-1, RAID-10 requires all devices to\n 154:\t\t  be the same size (or at least, only as much as the smallest device\n 155:\t\t  will be used).\n 156:\t\t  RAID-10 provides a variety of layouts that provide different levels\n 157:\t\t  of redundancy and performance.\n 158:\t\n 159:\t\t  RAID-10 requires mdadm-1.7.0 or later, available at:\n 160:\t\n 161:\t\t  https://www.kernel.org/pub/linux/utils/raid/mdadm/\n 162:\t\n 163:\t\t  If unsure, say Y.\n 164:\t\n 165:\tconfig MD_RAID456\n 166:\t\ttristate \"RAID-4/RAID-5/RAID-6 mode\"\n 167:\t\tdepends on BLK_DEV_MD\n 168:\t\tselect RAID6_PQ\n 169:\t\tselect CRC32\n 170:\t\tselect ASYNC_MEMCPY\n 171:\t\tselect ASYNC_XOR\n 172:\t\tselect ASYNC_PQ\n 173:\t\tselect ASYNC_RAID6_RECOV\n 174:\t\thelp\n 175:\t\t  A RAID-5 set of N drives with a capacity of C MB per drive provides\n 176:\t\t  the capacity of C * (N - 1) MB, and protects against a failure\n 177:\t\t  of a single drive. For a given sector (row) number, (N - 1) drives\n 178:\t\t  contain data sectors, and one drive contains the parity protection.\n 179:\t\t  For a RAID-4 set, the parity blocks are present on a single drive,\n 180:\t\t  while a RAID-5 set distributes the parity across the drives in one\n 181:\t\t  of the available parity distribution methods.\n 182:\t\n 183:\t\t  A RAID-6 set of N drives with a capacity of C MB per drive\n 184:\t\t  provides the capacity of C * (N - 2) MB, and protects\n 185:\t\t  against a failure of any two drives. For a given sector\n 186:\t\t  (row) number, (N - 2) drives contain data sectors, and two\n 187:\t\t  drives contains two independent redundancy syndromes.  Like\n 188:\t\t  RAID-5, RAID-6 distributes the syndromes across the drives\n 189:\t\t  in one of the available parity distribution methods.\n 190:\t\n 191:\t\t  Information about Software RAID on Linux is contained in the\n 192:\t\t  Software-RAID mini-HOWTO, available from\n 193:\t\t  \u003chttps://www.tldp.org/docs.html#howto\u003e. There you will also\n 194:\t\t  learn where to get the supporting user space utilities raidtools.\n 195:\t\n 196:\t\t  If you want to use such a RAID-4/RAID-5/RAID-6 set, say Y.  To\n 197:\t\t  compile this code as a module, choose M here: the module\n 198:\t\t  will be called raid456.\n 199:\t\n 200:\t\t  If unsure, say Y.\n 201:\t\n 202:\tconfig MD_CLUSTER\n 203:\t\ttristate \"Cluster Support for MD\"\n 204:\t\tselect MD_BITMAP\n 205:\t\tdepends on BLK_DEV_MD\n 206:\t\tdepends on DLM\n 207:\t\tdefault n\n 208:\t\thelp\n 209:\t\tClustering support for MD devices. This enables locking and\n 210:\t\tsynchronization across multiple systems on the cluster, so all\n 211:\t\tnodes in the cluster can access the MD devices simultaneously.\n 212:\t\n 213:\t\tThis brings the redundancy (and uptime) of RAID levels across the\n 214:\t\tnodes of the cluster. Currently, it can work with raid1 and raid10\n 215:\t\t(limited support).\n 216:\t\n 217:\t\tIf unsure, say N.\n 218:\t\n 219:\tsource \"drivers/md/bcache/Kconfig\"\n 220:\t\n"
}

							input: 20891
							output: 29
							thoughts: 10

Okay, here's my attempt at summarizing that thought process, keeping in mind I'm speaking to a fellow expert and using first-person perspective:

**Checking DM-RAID in a Broader Context**

Right, so we're looking at this particular issue, and I've already considered [mention previous points if the original context is available]. Now, I need to expand my focus a bit. Let's make sure we haven't overlooked something related to DM-RAID. It's often the elephant in the room that gets forgotten when diagnosing complex storage issues. Things get hairy fast when you have LVM, MD and DM-RAID all playing together. I need to quickly recall the typical failure modes, gotchas, and interactions between the components in that stack. Specifically, are the kernel modules loaded? Is the device mapper layer behaving as expected, and how about the RAID configuration itself? I'll probably also need to consider some of the more advanced features like multipathing and snapshotting as potential complicating factors. I suspect DM-RAID here, but its worth a quick check to rule it out before I go deeper down a rabbit hole.

{
  "Expression": "config DM_RAID",
  "PathPrefix": "drivers/md/"
}

{
  "Output": "drivers/md/Kconfig=420=config DM_LOG_USERSPACE\n--\ndrivers/md/Kconfig-430-\ndrivers/md/Kconfig:431:config DM_RAID\ndrivers/md/Kconfig-432-       tristate \"RAID 1/4/5/6/10 target\"\n"
}

							input: 21265
							output: 29
							thoughts: 1065

**Analysis of Potential Fuzzing Targets in the MD Layer**

Okay, let's break this down. First, the question of whether this patch is "WorthFuzzing" is a resounding "yes." The modifications touch critical areas of the MD (Multiple Device) layer: locking hierarchies involving mutexes and locks like `q->limits_lock` and `reconfig_mutex`, queue limits handling, and disk addition/removal, all across several RAID personalities. Specifically, changes in ioctl handling, sysfs interactions, sync thread execution, and `hot_add_disk` callbacks indicate a high likelihood of introducing race conditions, deadlocks, or other concurrency-related bugs. Given that these code paths are directly accessible from user space via ioctls and sysfs, fuzzing is absolutely crucial to test the robustness of the new locking order and queue limit implementations.

Now, let's identify the specific "FocusSymbols" to target with the fuzzer. We need to select the key functions and entry points that encapsulate the changed logic.

Here's my list, based on the modified and newly introduced functions:

* In `drivers/md/md.c`: `mddev_stack_rdev_into`, `mddev_update_io_opt`, `md_add_new_disk`, `remove_and_add_spares`, `hot_remove_disk`, `rdev_attr_store`, `md_ioctl`, `md_start_sync`, `check_sb_changes`, `add_bound_rdev`.
* In `drivers/md/raid1.c`: `raid1_add_disk`
* In `drivers/md/raid10.c`: `raid10_add_disk`
* In `drivers/md/raid5.c`: `raid5_add_disk`, `raid5_store_skip_copy`
* In `drivers/md/md-linear.c`: `linear_add`

I also confirmed that `queue_limits_start_update_trylock` is a static inline in `include/linux/blkdev.h`, as expected.

Finally, we need to ensure the correct kernel configurations are enabled to trigger the fuzzing. The patch touches multiple RAID personalities and related functionality, so we need to enable the following configurations to ensure all relevant code paths are tested:

* `BLK_DEV_MD`
* `MD_RAID1`
* `MD_RAID10`
* `MD_RAID456`
* `MD_LINEAR`
* `DM_RAID`

I am also double-checking the configuration coverage. The patch modifies files related to multiple RAID implementations, so enabling these configuration options should cover the modified code. In addition to the above, I'll need to remember that `DM_RAID` (which depends on `BLK_DEV_DM` and indirectly on `MD_RAID456`) is relevant because of the `drivers/md/dm-raid.c` change, and to a lesser extent, `MD_AUTODETECT` as well. With this configuration and focusing on the listed symbols, we can perform a comprehensive fuzzing campaign on this patch.

{
  "Expression": "config DM_RAID",
  "PathPrefix": "drivers/md/"
}

{
  "Output": "drivers/md/Kconfig=420=config DM_LOG_USERSPACE\n--\ndrivers/md/Kconfig-430-\ndrivers/md/Kconfig:431:config DM_RAID\ndrivers/md/Kconfig-432-       tristate \"RAID 1/4/5/6/10 target\"\n"
}

							input: 23150
							output: 34
							thoughts: 19

Here's my summary, as though I'm thinking through this process:

**Diving into the Kernel Configuration for RAID**

Okay, so I need to track down something related to the RAID configuration. The context suggests that the relevant code will be in the kernel configuration files. Right, that makes sense. Let's start with `drivers/md/Kconfig`. This is where all the module configuration for the RAID drivers will be. It's a natural starting point. Specifically, let's zero in on line 431. I'm hoping to get a clue there to what is being configured and where things are defined. I have a hunch that whatever I'm looking for will be related to whatever is on that line.

{
  "File": "drivers/md/Kconfig",
  "FirstLine": 425,
  "LineCount": 20
}

{
  "Contents": " 425:\t\t  The userspace logging module provides a mechanism for\n 426:\t\t  relaying the dm-dirty-log API to userspace.  Log designs\n 427:\t\t  which are more suited to userspace implementation (e.g.\n 428:\t\t  shared storage logs) or experimental logs can be implemented\n 429:\t\t  by leveraging this framework.\n 430:\t\n 431:\tconfig DM_RAID\n 432:\t       tristate \"RAID 1/4/5/6/10 target\"\n 433:\t       depends on BLK_DEV_DM\n 434:\t       select MD_RAID0\n 435:\t       select MD_RAID1\n 436:\t       select MD_RAID10\n 437:\t       select MD_RAID456\n 438:\t       select MD_BITMAP\n 439:\t       select BLK_DEV_MD\n 440:\t\thelp\n 441:\t\t A dm target that supports RAID1, RAID10, RAID4, RAID5 and RAID6 mappings\n 442:\t\n 443:\t\t A RAID-5 set of N drives with a capacity of C MB per drive provides\n 444:\t\t the capacity of C * (N - 1) MB, and protects against a failure\n"
}

							input: 23704
							output: 285
							thoughts: 385

**My Analysis of the MD RAID Layer Refactoring**

Okay, so I've been looking at this patch and, based on the configs—`BLK_DEV_MD`, `MD_RAID1`, `MD_RAID10`, `MD_RAID456`, `MD_LINEAR`, and `DM_RAID`—it's clearly focused on the MD (software RAID) layer. The core of this refactor seems to be about how queue limits are updated and the order in which locks are acquired, specifically concerning the interaction between `q->limits_lock`, `reconfig_mutex`, and device suspension.

They're introducing `queue_limits_start_update_trylock()` and `mddev_stack_rdev_into()`. Anytime you mess with lock hierarchies in this kind of low-level code, my antenna go up. We're talking about operations during hot-add, spare removal/addition, reshapes, and those are all sensitive points. It's also worth noting how many interactions the kernel has with those. We should be extra vigilant, and that means we will need to give it special attention to avoid subtle deadlocks, locking inconsistencies, and potential state regressions.

Let's do a sanity check on the focus symbols. Looks like we've got a good list: `mddev_stack_rdev_into`, `mddev_update_io_opt`, `md_add_new_disk`, `remove_and_add_spares`, `rdev_attr_store`, `md_start_sync`, `raid1_add_disk`, `raid10_add_disk`, `raid5_add_disk`, `raid5_store_skip_copy`, and `linear_add`. This looks like a solid list.

They are all specific to MD RAID, and that's exactly what we want. They are also present in the modified C files which means it is a good starting point for review.

I need to flag this for fuzzing and extensive testing. Now, I'm going to call `set-results`.

{
  "EnableConfigs": [
    "BLK_DEV_MD",
    "MD_RAID1",
    "MD_RAID10",
    "MD_RAID456",
    "MD_LINEAR",
    "DM_RAID"
  ],
  "FocusSymbols": [
    "mddev_stack_rdev_into",
    "mddev_update_io_opt",
    "md_add_new_disk",
    "remove_and_add_spares",
    "rdev_attr_store",
    "md_start_sync",
    "raid1_add_disk",
    "raid10_add_disk",
    "raid5_add_disk",
    "raid5_store_skip_copy",
    "linear_add"
  ],
  "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.",
  "WorthFuzzing": true
}

{
  "EnableConfigs": [
    "BLK_DEV_MD",
    "MD_RAID1",
    "MD_RAID10",
    "MD_RAID456",
    "MD_LINEAR",
    "DM_RAID"
  ],
  "FocusSymbols": [
    "mddev_stack_rdev_into",
    "mddev_update_io_opt",
    "md_add_new_disk",
    "remove_and_add_spares",
    "rdev_attr_store",
    "md_start_sync",
    "raid1_add_disk",
    "raid10_add_disk",
    "raid5_add_disk",
    "raid5_store_skip_copy",
    "linear_add"
  ],
  "Reasoning": "The patch restructures lock acquisition and queue limits propagation in the MD (software RAID) layer to prevent deadlocks between q-\u003elimits_lock, reconfig_mutex, and mddev_suspend. It alters disk addition/removal and sysfs/ioctl handling across multiple RAID personalities (raid1, raid10, raid5, linear, dm-raid). Fuzzing is warranted to discover potential deadlocks, locking order violations, race conditions, or state corruptions during concurrent RAID configuration operations.",
  "WorthFuzzing": true
}

{
  "WorthFuzzing": true
}

{
  "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.",
  "NeedsKMSAN": false
}

You are an expert Linux kernel security engineer specializing in kernel memory
error detectors (KASAN and KMSAN). Your job is to review the provided patch series and
determine if the code changes justify spawning a dedicated KMSAN (KernelMemorySanitizer)
fuzzing session in addition to standard KASAN fuzzing.

CRITICAL DISTINCTION BETWEEN KASAN AND KMSAN:
- Standard KASAN kernel builds (upstream-apparmor-kasan.config) already enable
  a comprehensive suite of debugging tools and sanitizers, including KASAN
  (out-of-bounds accesses, use-after-free, double free, invalid free), LOCKDEP
  (locking bugs and deadlocks), UB-sanitizers, and memory corruption checks.
- KMSAN (KernelMemorySanitizer) detects reads of UNINITIALIZED memory (stack, heap,
  or page allocations) and kernel-to-user memory info-leaks.

Rule: THERE IS NO SENSE IN RUNNING A KMSAN SESSION IF A BUG CAN BE CAUGHT BY KASAN,
LOCKDEP, OR OTHER STANDARD BUG DETECTORS.
A dedicated KMSAN fuzzing session incurs significant resource costs. You must ONLY
set NeedsKMSAN=true if the code changes introduce or expose UNINITIALIZED MEMORY risks
that are detected ONLY by KMSAN.

Look holistically at the patch series and surrounding code. Even if no direct
uninitialized field accesses or new buffer allocations are added in the diff itself,
a patch may alter control flow, bounds checking, or data length calculations in ways
that change how the rest of the code operates on existing buffers (e.g. allowing
uninitialized stack/heap memory to be read, copied to user space, or used in control
flow). Do not hesitate to use your code access tools to inspect the surrounding code,
called functions, and callers.

Set NeedsKMSAN=true ONLY IF the patch introduces or modifies:
1. Kernel structures sent to user space (via copy_to_user, put_user, netlink skb
   attributes, ioctl output arguments, socket options, or BPF buffers) where fields
   or structure padding might not be fully initialized/zeroed.
2. Conditional logic or branching that depends on potentially uninitialized variables
   or struct fields.
3. Allocation or initialization of complex data structures where uninitialized fields
   could be read later in reachable code paths.
4. Bounds checks, lengths, or logic in a way that allows surrounding code to access
   uninitialized bytes of existing buffers.

Set NeedsKMSAN=false IF:
- The code changes primarily risk out-of-bounds access, array overflows, NULL pointer
  dereferences, locking deadlocks, or use-after-free bugs (these are already caught
  by KASAN, LOCKDEP, or standard bug detectors).
- All stack/heap structures touched or introduced by the patch are fully zeroed
  or initialized (e.g. using = {0}, memset, kzalloc) before being read or copied.
- The patch does not introduce any risk of uninitialized memory usage or info-leaks.

Use your code access tools to inspect the surrounding code if necessary, then provide
detailed KMSANReasoning contrasting KASAN vs KMSAN applicability for this patch.
Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Target architecture: amd64

For your convenience, here is the diff of the changes:
commit f3c6bf266a24cf5754b7bc045011e743d2e3d77e
Author: syz-cluster <triage@syzkaller.com>
Date:   Mon Sep 7 18:13:15 2026 +0000

    syz-cluster: applied patch under review

diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 8f5a5e1342a95..21a1922bee4fb 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -3923,7 +3923,7 @@ static void attempt_restore_of_faulty_devices(struct raid_set *rs)
 			clear_bit(Faulty, &r->flags);
 			clear_bit(WriteErrorSeen, &r->flags);
 
-			if (mddev->pers->hot_add_disk(mddev, r)) {
+			if (mddev->pers->hot_add_disk(mddev, r, NULL)) {
 				/* Failed to revive this device, try next */
 				r->raid_disk = r->saved_raid_disk = -1;
 				r->flags = flags;
diff --git a/drivers/md/md-autodetect.c b/drivers/md/md-autodetect.c
index 4b80165afd233..929513109657f 100644
--- a/drivers/md/md-autodetect.c
+++ b/drivers/md/md-autodetect.c
@@ -213,7 +213,7 @@ static void __init md_setup_drive(struct md_setup_args *args)
 				(1 << MD_DISK_ACTIVE) | (1 << MD_DISK_SYNC);
 		}
 
-		md_add_new_disk(mddev, &dinfo);
+		md_add_new_disk(mddev, &dinfo, NULL);
 	}
 
 	if (!err)
diff --git a/drivers/md/md-linear.c b/drivers/md/md-linear.c
index 73b367b61b873..1f44c2d7db93d 100644
--- a/drivers/md/md-linear.c
+++ b/drivers/md/md-linear.c
@@ -186,7 +186,8 @@ static int linear_run(struct mddev *mddev)
 	return ret;
 }
 
-static int linear_add(struct mddev *mddev, struct md_rdev *rdev)
+static int linear_add(struct mddev *mddev, struct md_rdev *rdev,
+		      struct queue_limits *lim)
 {
 	/* Adding a drive to a linear array allows the array to grow.
 	 * It is permitted if the new drive has a matching superblock
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3d..c4054d06d1070 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -94,8 +94,8 @@ static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
  */
 static struct workqueue_struct *md_misc_wq;
 
-static int remove_and_add_spares(struct mddev *mddev,
-				 struct md_rdev *this);
+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,
+				 struct queue_limits *lim);
 static void mddev_detach(struct mddev *mddev);
 static void export_rdev(struct md_rdev *rdev);
 static void md_wakeup_thread_directly(struct md_thread __rcu **thread);
@@ -2981,7 +2981,7 @@ void md_update_sb(struct mddev *mddev, int force_change)
 }
 EXPORT_SYMBOL(md_update_sb);
 
-static int add_bound_rdev(struct md_rdev *rdev)
+static int add_bound_rdev(struct md_rdev *rdev, struct queue_limits *lim)
 {
 	struct mddev *mddev = rdev->mddev;
 	int err = 0;
@@ -2994,7 +2994,7 @@ static int add_bound_rdev(struct md_rdev *rdev)
 		 */
 		super_types[mddev->major_version].
 			validate_super(mddev, NULL/*freshest*/, rdev);
-		err = mddev->pers->hot_add_disk(mddev, rdev);
+		err = mddev->pers->hot_add_disk(mddev, rdev, lim);
 		if (err) {
 			md_kick_rdev_from_array(rdev);
 			return err;
@@ -3033,7 +3033,13 @@ static int cmd_match(const char *cmd, const char *str)
 struct rdev_sysfs_entry {
 	struct attribute attr;
 	ssize_t (*show)(struct md_rdev *, char *);
-	ssize_t (*store)(struct md_rdev *, const char *, size_t);
+	/*
+	 * @lim: a queue limits update the caller owns, or NULL.  Stores that
+	 * can add a leg to the array must stack into it rather than take
+	 * q->limits_lock themselves, see md_start_sync().
+	 */
+	ssize_t (*store)(struct md_rdev *rdev, const char *page, size_t len,
+			 struct queue_limits *lim);
 };
 
 static ssize_t
@@ -3079,7 +3085,8 @@ state_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-state_store(struct md_rdev *rdev, const char *buf, size_t len)
+state_store(struct md_rdev *rdev, const char *buf, size_t len,
+	    struct queue_limits *lim)
 {
 	/* can write
 	 *  faulty  - simulates an error
@@ -3110,7 +3117,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 	} else if (cmd_match(buf, "remove")) {
 		if (rdev->mddev->pers) {
 			clear_bit(Blocked, &rdev->flags);
-			remove_and_add_spares(rdev->mddev, rdev);
+			remove_and_add_spares(rdev->mddev, rdev, lim);
 		}
 		if (rdev->raid_disk >= 0)
 			err = -EBUSY;
@@ -3229,7 +3236,7 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
 			if (!mddev_is_clustered(rdev->mddev) ||
 			    (err = mddev->cluster_ops->gather_bitmaps(rdev)) == 0) {
 				clear_bit(Faulty, &rdev->flags);
-				err = add_bound_rdev(rdev);
+				err = add_bound_rdev(rdev, lim);
 			}
 		} else
 			err = -EBUSY;
@@ -3257,7 +3264,8 @@ errors_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-errors_store(struct md_rdev *rdev, const char *buf, size_t len)
+errors_store(struct md_rdev *rdev, const char *buf, size_t len,
+	     struct queue_limits *lim)
 {
 	unsigned int n;
 	int rv;
@@ -3283,7 +3291,8 @@ slot_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-slot_store(struct md_rdev *rdev, const char *buf, size_t len)
+slot_store(struct md_rdev *rdev, const char *buf, size_t len,
+	   struct queue_limits *lim)
 {
 	int slot;
 	int err;
@@ -3314,7 +3323,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
 		if (rdev->mddev->pers->hot_remove_disk == NULL)
 			return -EINVAL;
 		clear_bit(Blocked, &rdev->flags);
-		remove_and_add_spares(rdev->mddev, rdev);
+		remove_and_add_spares(rdev->mddev, rdev, lim);
 		if (rdev->raid_disk >= 0)
 			return -EBUSY;
 		set_bit(MD_RECOVERY_NEEDED, &rdev->mddev->recovery);
@@ -3344,7 +3353,8 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
 			rdev->saved_raid_disk = -1;
 		clear_bit(In_sync, &rdev->flags);
 		clear_bit(Bitmap_sync, &rdev->flags);
-		err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev);
+		err = rdev->mddev->pers->hot_add_disk(rdev->mddev, rdev,
+						     lim);
 		if (err) {
 			rdev->raid_disk = -1;
 			return err;
@@ -3377,7 +3387,8 @@ offset_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-offset_store(struct md_rdev *rdev, const char *buf, size_t len)
+offset_store(struct md_rdev *rdev, const char *buf, size_t len,
+	     struct queue_limits *lim)
 {
 	unsigned long long offset;
 	if (kstrtoull(buf, 10, &offset) < 0)
@@ -3403,7 +3414,8 @@ static ssize_t new_offset_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t new_offset_store(struct md_rdev *rdev,
-				const char *buf, size_t len)
+				const char *buf, size_t len,
+				struct queue_limits *lim)
 {
 	unsigned long long new_offset;
 	struct mddev *mddev = rdev->mddev;
@@ -3510,7 +3522,8 @@ static int strict_blocks_to_sectors(const char *buf, sector_t *sectors)
 }
 
 static ssize_t
-rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len,
+		struct queue_limits *lim)
 {
 	struct mddev *my_mddev = rdev->mddev;
 	sector_t oldsectors = rdev->sectors;
@@ -3572,7 +3585,8 @@ static ssize_t recovery_start_show(struct md_rdev *rdev, char *page)
 	return sprintf(page, "%llu\n", recovery_start);
 }
 
-static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len)
+static ssize_t recovery_start_store(struct md_rdev *rdev, const char *buf, size_t len,
+				    struct queue_limits *lim)
 {
 	unsigned long long recovery_start;
 
@@ -3611,7 +3625,9 @@ static ssize_t bb_show(struct md_rdev *rdev, char *page)
 {
 	return badblocks_show(&rdev->badblocks, page, 0);
 }
-static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len)
+
+static ssize_t bb_store(struct md_rdev *rdev, const char *page, size_t len,
+			struct queue_limits *lim)
 {
 	int rv = badblocks_store(&rdev->badblocks, page, len, 0);
 	/* Maybe that ack was all we needed */
@@ -3626,7 +3642,9 @@ static ssize_t ubb_show(struct md_rdev *rdev, char *page)
 {
 	return badblocks_show(&rdev->badblocks, page, 1);
 }
-static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len)
+
+static ssize_t ubb_store(struct md_rdev *rdev, const char *page, size_t len,
+			 struct queue_limits *lim)
 {
 	return badblocks_store(&rdev->badblocks, page, len, 1);
 }
@@ -3640,7 +3658,8 @@ ppl_sector_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len)
+ppl_sector_store(struct md_rdev *rdev, const char *buf, size_t len,
+		 struct queue_limits *lim)
 {
 	unsigned long long sector;
 
@@ -3679,7 +3698,8 @@ ppl_size_show(struct md_rdev *rdev, char *page)
 }
 
 static ssize_t
-ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len)
+ppl_size_store(struct md_rdev *rdev, const char *buf, size_t len,
+	       struct queue_limits *lim)
 {
 	unsigned int size;
 
@@ -3740,6 +3760,9 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 	struct rdev_sysfs_entry *entry = container_of(attr, struct rdev_sysfs_entry, attr);
 	struct md_rdev *rdev = container_of(kobj, struct md_rdev, kobj);
 	struct kernfs_node *kn = NULL;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	bool suspend = false;
 	ssize_t rv;
 	struct mddev *mddev = READ_ONCE(rdev->mddev);
@@ -3760,15 +3783,37 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
 			suspend = true;
 	}
 
+	/*
+	 * These can add a leg back, which stacks its limits; the other
+	 * state_store() values never reach ->hot_add_disk().  q->limits_lock
+	 * nests outside the lock and the suspend, see md_start_sync().
+	 */
+	if ((entry->store == slot_store ||
+	     (entry->store == state_store &&
+	      (cmd_match(page, "remove") || cmd_match(page, "re-add")))) &&
+	    !mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	rv = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);
 	if (!rv) {
 		if (rdev->mddev == NULL)
 			rv = -ENODEV;
 		else
-			rv = entry->store(rdev, page, length);
+			rv = entry->store(rdev, page, length, limp);
+		/* apply the limits before the array takes I/O again */
+		if (limp) {
+			queue_limits_commit_update(q, limp);
+			limp = NULL;
+		}
 		suspend ? mddev_unlock_and_resume(mddev) : mddev_unlock(mddev);
 	}
 
+	if (limp)
+		queue_limits_commit_update(q, limp);
+
 	if (kn)
 		sysfs_unbreak_active_protection(kn);
 
@@ -6275,20 +6320,89 @@ int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev)
 }
 EXPORT_SYMBOL_GPL(mddev_stack_new_rdev);
 
+/*
+ * Stack a new rdev into limits the caller already holds limits_lock for and
+ * will commit itself.  Used from paths that must take limits_lock before
+ * quiescing the array, see md_start_sync().
+ */
+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
+{
+	struct queue_limits tmp = *lim;
+
+	if (mddev_is_dm(mddev))
+		return 0;
+
+	if (queue_logical_block_size(rdev->bdev->bd_disk->queue) >
+	    queue_logical_block_size(mddev->gendisk->queue)) {
+		pr_err("%s: incompatible logical_block_size, can not add\n",
+		       mdname(mddev));
+		return -EINVAL;
+	}
+
+	queue_limits_stack_bdev(&tmp, rdev->bdev, rdev->data_offset,
+				mddev->gendisk->disk_name);
+
+	if (!queue_limits_stack_integrity_bdev(&tmp, rdev->bdev)) {
+		pr_err("%s: incompatible integrity profile for %pg\n",
+		       mdname(mddev), rdev->bdev);
+		return -ENXIO;
+	}
+
+	*lim = tmp;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(mddev_stack_rdev_into);
+
+/* for callers that must not wait for q->limits_lock, see md_start_sync() */
+static bool mddev_stack_limits_trylock(struct mddev *mddev,
+				       struct queue_limits *lim)
+{
+	struct request_queue *q;
+
+	if (mddev_is_dm(mddev))
+		return false;
+
+	q = mddev->gendisk->queue;
+
+	return queue_limits_start_update_trylock(q, lim);
+}
+
 /* update the optimal I/O size after a reshape */
-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes)
+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,
+			 struct queue_limits *lim)
 {
-	struct queue_limits lim;
+	struct queue_limits own;
 
 	if (mddev_is_dm(mddev))
 		return;
 
+	/*
+	 * With an update owned by the caller just change it in place; it is
+	 * committed, and the array resumed, by whoever started it.  Taking
+	 * q->limits_lock here would nest it inside reconfig_mutex and the
+	 * suspend, which deadlocks, see md_start_sync().
+	 */
+	if (lim) {
+		lim->io_opt = lim->io_min * nr_stripes;
+		return;
+	}
+
+	/*
+	 * Called from the sync thread, which md_reap_sync_thread() waits for
+	 * with reconfig_mutex held, so don't wait for q->limits_lock here.
+	 * io_opt is a hint, skipping it on a contended pass is fine.
+	 */
+	if (!mddev_stack_limits_trylock(mddev, &own))
+		return;
+
 	/* don't bother updating io_opt if we can't suspend the array */
-	if (mddev_suspend(mddev, false) < 0)
+	if (mddev_suspend(mddev, false) < 0) {
+		queue_limits_cancel_update(mddev->gendisk->queue);
 		return;
-	lim = queue_limits_start_update(mddev->gendisk->queue);
-	lim.io_opt = lim.io_min * nr_stripes;
-	queue_limits_commit_update(mddev->gendisk->queue, &lim);
+	}
+	own.io_opt = own.io_min * nr_stripes;
+	queue_limits_commit_update(mddev->gendisk->queue, &own);
 	mddev_resume(mddev);
 }
 EXPORT_SYMBOL_GPL(mddev_update_io_opt);
@@ -7486,7 +7600,8 @@ static int get_disk_info(struct mddev *mddev, void __user * arg)
 	return 0;
 }
 
-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,
+		    struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 	dev_t dev = MKDEV(info->major,info->minor);
@@ -7634,11 +7749,11 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
 				if (err)
 					mddev->cluster_ops->add_new_disk_cancel(mddev);
 				else
-					err = add_bound_rdev(rdev);
+					err = add_bound_rdev(rdev, lim);
 			}
 
 		} else if (!err)
-			err = add_bound_rdev(rdev);
+			err = add_bound_rdev(rdev, lim);
 
 		return err;
 	}
@@ -7691,7 +7806,8 @@ int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info)
 	return 0;
 }
 
-static int hot_remove_disk(struct mddev *mddev, dev_t dev)
+static int hot_remove_disk(struct mddev *mddev, dev_t dev,
+			   struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 
@@ -7706,7 +7822,7 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev)
 		goto kick_rdev;
 
 	clear_bit(Blocked, &rdev->flags);
-	remove_and_add_spares(mddev, rdev);
+	remove_and_add_spares(mddev, rdev, lim);
 
 	if (rdev->raid_disk >= 0)
 		goto busy;
@@ -8291,6 +8407,22 @@ static inline int md_ioctl_valid(unsigned int cmd)
 	}
 }
 
+/*
+ * Commands that can reach ->hot_add_disk().  ADD_NEW_DISK only does so for a
+ * journal device or a personality without ->hot_remove_disk, but that depends
+ * on disk info still in user memory here, so it is included as a whole.
+ */
+static bool md_ioctl_may_add_disk(unsigned int cmd)
+{
+	switch (cmd) {
+	case ADD_NEW_DISK:
+	case HOT_REMOVE_DISK:
+		return true;
+	default:
+		return false;
+	}
+}
+
 static bool md_ioctl_need_suspend(unsigned int cmd)
 {
 	switch (cmd) {
@@ -8346,6 +8478,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	unsigned int noio_flags = 0;
 	void __user *argp = (void __user *)arg;
 	struct mddev *mddev = NULL;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	bool suspend;
 
 	err = md_ioctl_valid(cmd);
@@ -8396,11 +8531,20 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	if (!md_is_rdwr(mddev))
 		flush_work(&mddev->sync_work);
 
+	/* q->limits_lock nests outside both, see md_start_sync() */
+	if (md_ioctl_may_add_disk(cmd) && !mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	suspend = md_ioctl_need_suspend(cmd);
 	err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev);
 	if (err) {
 		pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n",
 			 err, cmd);
+		if (limp)
+			queue_limits_cancel_update(q);
 		goto out;
 	}
 	if (suspend)
@@ -8442,7 +8586,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 		goto unlock;
 
 	case HOT_REMOVE_DISK:
-		err = hot_remove_disk(mddev, new_decode_dev(arg));
+		err = hot_remove_disk(mddev, new_decode_dev(arg), limp);
 		goto unlock;
 
 	case ADD_NEW_DISK:
@@ -8458,7 +8602,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 				/* Need to clear read-only for this */
 				break;
 			else
-				err = md_add_new_disk(mddev, &info);
+				err = md_add_new_disk(mddev, &info, limp);
 			goto unlock;
 		}
 		break;
@@ -8496,7 +8640,7 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 		if (copy_from_user(&info, argp, sizeof(info)))
 			err = -EFAULT;
 		else
-			err = md_add_new_disk(mddev, &info);
+			err = md_add_new_disk(mddev, &info, limp);
 		goto unlock;
 	}
 
@@ -8529,6 +8673,9 @@ static int md_ioctl(struct block_device *bdev, blk_mode_t mode,
 	    err != -EINVAL)
 		mddev->hold_active = 0;
 
+	if (limp)
+		queue_limits_commit_update(q, limp);
+
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		mddev_unlock_and_resume(mddev);
@@ -10167,8 +10314,8 @@ static int remove_spares(struct mddev *mddev, struct md_rdev *this)
 	return removed;
 }
 
-static int remove_and_add_spares(struct mddev *mddev,
-				 struct md_rdev *this)
+static int remove_and_add_spares(struct mddev *mddev, struct md_rdev *this,
+				 struct queue_limits *lim)
 {
 	struct md_rdev *rdev;
 	int spares = 0;
@@ -10191,7 +10338,7 @@ static int remove_and_add_spares(struct mddev *mddev,
 			continue;
 		if (!test_bit(Journal, &rdev->flags))
 			rdev->recovery_offset = 0;
-		if (mddev->pers->hot_add_disk(mddev, rdev) == 0) {
+		if (mddev->pers->hot_add_disk(mddev, rdev, lim) == 0) {
 			/* failure here is OK */
 			sysfs_link_rdev(mddev, rdev);
 			if (!test_bit(Journal, &rdev->flags))
@@ -10206,7 +10353,8 @@ static int remove_and_add_spares(struct mddev *mddev,
 	return spares;
 }
 
-static bool md_choose_sync_action(struct mddev *mddev, int *spares)
+static bool md_choose_sync_action(struct mddev *mddev, int *spares,
+				  struct queue_limits *lim)
 {
 	/* Check if reshape is in progress first. */
 	if (mddev->reshape_position != MaxSector) {
@@ -10234,7 +10382,7 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
 	 * also removed and re-added, to allow the personality to fail the
 	 * re-add.
 	 */
-	*spares = remove_and_add_spares(mddev, NULL);
+	*spares = remove_and_add_spares(mddev, NULL, lim);
 	if (*spares || test_bit(MD_RECOVERY_LAZY_RECOVER, &mddev->recovery)) {
 		clear_bit(MD_RECOVERY_SYNC, &mddev->recovery);
 		clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
@@ -10256,6 +10404,9 @@ static bool md_choose_sync_action(struct mddev *mddev, int *spares)
 static void md_start_sync(struct work_struct *ws)
 {
 	struct mddev *mddev = container_of(ws, struct mddev, sync_work);
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	int spares = 0;
 	bool suspend = false;
 	unsigned int noio_flags = 0;
@@ -10267,6 +10418,17 @@ static void md_start_sync(struct work_struct *ws)
 	 */
 	if ((mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
 	    md_spares_need_change(mddev)) {
+		/*
+		 * Adding a spare below stacks its limits, which needs
+		 * q->limits_lock.  Take it before suspending: its holder
+		 * waits in blk_mq_freeze_queue() for I/O that
+		 * mddev->suspended holds back, so the other order deadlocks.
+		 */
+		if (!mddev_is_dm(mddev)) {
+			q = mddev->gendisk->queue;
+			lim = queue_limits_start_update(q);
+			limp = &lim;
+		}
 		suspend = true;
 		mddev_suspend(mddev, false);
 		noio_flags = memalloc_noio_save();
@@ -10281,6 +10443,12 @@ static void md_start_sync(struct work_struct *ws)
 	if (!suspend && (mddev->reshape_position == MaxSector || !md_is_rdwr(mddev)) &&
 	    md_spares_need_change(mddev)) {
 		mddev_unlock(mddev);
+		/* see above: q->limits_lock nests outside both */
+		if (!mddev_is_dm(mddev)) {
+			q = mddev->gendisk->queue;
+			lim = queue_limits_start_update(q);
+			limp = &lim;
+		}
 		mddev_suspend_and_lock_nointr(mddev);
 		suspend = true;
 		noio_flags = memalloc_noio_save();
@@ -10294,11 +10462,11 @@ static void md_start_sync(struct work_struct *ws)
 		 * As we only add devices that are already in-sync, we can
 		 * activate the spares immediately.
 		 */
-		remove_and_add_spares(mddev, NULL);
+		remove_and_add_spares(mddev, NULL, limp);
 		goto not_running;
 	}
 
-	if (!md_choose_sync_action(mddev, &spares))
+	if (!md_choose_sync_action(mddev, &spares, limp))
 		goto not_running;
 
 	if (!mddev->pers->sync_request)
@@ -10329,6 +10497,8 @@ static void md_start_sync(struct work_struct *ws)
 	 *     https://bugzilla.kernel.org/show_bug.cgi?id=218200
 	 * Therefore, use __mddev_resume(mddev, false).
 	 */
+	if (limp)
+		queue_limits_commit_update(q, limp);
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		__mddev_resume(mddev, false);
@@ -10351,6 +10521,8 @@ static void md_start_sync(struct work_struct *ws)
 	 *     https://bugzilla.kernel.org/show_bug.cgi?id=218200
 	 * Therefore, use __mddev_resume(mddev, false).
 	 */
+	if (limp)
+		queue_limits_commit_update(q, limp);
 	if (suspend) {
 		memalloc_noio_restore(noio_flags);
 		__mddev_resume(mddev, false);
@@ -10793,6 +10965,7 @@ static int __init md_init(void)
 
 static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
 {
+	struct queue_limits lim;
 	struct mdp_superblock_1 *sb = page_address(rdev->sb_page);
 	struct md_rdev *rdev2, *tmp;
 	int role, ret;
@@ -10849,7 +11022,24 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
 					rdev2->saved_raid_disk = -1;
 				else
 					rdev2->saved_raid_disk = role;
-				ret = remove_and_add_spares(mddev, rdev2);
+				/*
+				 * reconfig_mutex is held, so don't wait for
+				 * q->limits_lock; MD_RECOVERY_NEEDED below
+				 * leaves a skipped add to md_start_sync().
+				 */
+				if (mddev_stack_limits_trylock(mddev, &lim)) {
+					struct request_queue *q =
+						mddev->gendisk->queue;
+
+					ret = remove_and_add_spares(mddev,
+								    rdev2, &lim);
+					queue_limits_commit_update(q, &lim);
+				} else if (mddev_is_dm(mddev)) {
+					ret = remove_and_add_spares(mddev,
+								    rdev2, NULL);
+				} else {
+					ret = remove_spares(mddev, rdev2);
+				}
 				pr_info("Activated spare: %pg\n",
 					rdev2->bdev);
 				/* wakeup mddev->thread here, so array could
diff --git a/drivers/md/md.h b/drivers/md/md.h
index b6d2e8929a0f9..ceca8cfcdcb9e 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -765,7 +765,8 @@ struct md_personality
 	 * if appropriate, and should abort recovery if needed
 	 */
 	void (*error_handler)(struct mddev *mddev, struct md_rdev *rdev);
-	int (*hot_add_disk) (struct mddev *mddev, struct md_rdev *rdev);
+	int (*hot_add_disk)(struct mddev *mddev, struct md_rdev *rdev,
+			    struct queue_limits *lim);
 	int (*hot_remove_disk) (struct mddev *mddev, struct md_rdev *rdev);
 	int (*spare_active) (struct mddev *mddev);
 	sector_t (*sync_request)(struct mddev *mddev, sector_t sector_nr,
@@ -1041,13 +1042,17 @@ struct mdu_disk_info_s;
 extern int mdp_major;
 void md_autostart_arrays(int part);
 int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info);
-int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info);
+int md_add_new_disk(struct mddev *mddev, struct mdu_disk_info_s *info,
+		    struct queue_limits *lim);
 int do_md_run(struct mddev *mddev);
 #define MDDEV_STACK_INTEGRITY	(1u << 0)
 int mddev_stack_rdev_limits(struct mddev *mddev, struct queue_limits *lim,
 		unsigned int flags);
 int mddev_stack_new_rdev(struct mddev *mddev, struct md_rdev *rdev);
-void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes);
+int mddev_stack_rdev_into(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim);
+void mddev_update_io_opt(struct mddev *mddev, unsigned int nr_stripes,
+			 struct queue_limits *lim);
 
 extern const struct block_device_operations md_fops;
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f0646fb24371f..dd348b5695d06 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1898,7 +1898,8 @@ static bool raid1_remove_conf(struct r1conf *conf, int disk)
 	return true;
 }
 
-static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
 {
 	struct r1conf *conf = mddev->private;
 	int err = -EEXIST;
@@ -1923,7 +1924,10 @@ static int raid1_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 	for (mirror = first; mirror <= last; mirror++) {
 		p = conf->mirrors + mirror;
 		if (!p->rdev) {
-			err = mddev_stack_new_rdev(mddev, rdev);
+			if (lim)
+				err = mddev_stack_rdev_into(mddev, rdev, lim);
+			else
+				err = mddev_stack_new_rdev(mddev, rdev);
 			if (err)
 				return err;
 
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 1093c798d9dde..641619328a6c4 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2095,7 +2095,8 @@ static int raid10_spare_active(struct mddev *mddev)
 	return count;
 }
 
-static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			   struct queue_limits *lim)
 {
 	struct r10conf *conf = mddev->private;
 	int err = -EEXIST;
@@ -2130,7 +2131,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 			continue;
 		}
 
-		err = mddev_stack_new_rdev(mddev, rdev);
+		if (lim)
+			err = mddev_stack_rdev_into(mddev, rdev, lim);
+		else
+			err = mddev_stack_new_rdev(mddev, rdev);
 		if (err)
 			return err;
 		p->head_position = 0;
@@ -2147,7 +2151,10 @@ static int raid10_add_disk(struct mddev *mddev, struct md_rdev *rdev)
 		clear_bit(In_sync, &rdev->flags);
 		set_bit(Replacement, &rdev->flags);
 		rdev->raid_disk = repl_slot;
-		err = mddev_stack_new_rdev(mddev, rdev);
+		if (lim)
+			err = mddev_stack_rdev_into(mddev, rdev, lim);
+		else
+			err = mddev_stack_new_rdev(mddev, rdev);
 		if (err)
 			return err;
 		conf->fullsync = 1;
@@ -4484,7 +4491,7 @@ static int raid10_start_reshape(struct mddev *mddev)
 		rdev_for_each(rdev, mddev)
 			if (rdev->raid_disk < 0 &&
 			    !test_bit(Faulty, &rdev->flags)) {
-				if (raid10_add_disk(mddev, rdev) == 0) {
+				if (raid10_add_disk(mddev, rdev, NULL) == 0) {
 					if (rdev->raid_disk >=
 					    conf->prev.raid_disks)
 						set_bit(In_sync, &rdev->flags);
@@ -4921,7 +4928,7 @@ static void end_reshape(struct r10conf *conf)
 	conf->reshape_safe = MaxSector;
 	spin_unlock_irq(&conf->device_lock);
 
-	mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf));
+	mddev_update_io_opt(conf->mddev, raid10_nr_stripes(conf), NULL);
 	conf->fullsync = 0;
 }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index b91545ce090de..22759c631c4d9 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7288,6 +7288,9 @@ static ssize_t
 raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)
 {
 	struct r5conf *conf;
+	struct request_queue *q = NULL;
+	struct queue_limits lim;
+	struct queue_limits *limp = NULL;
 	unsigned long new;
 	int err;
 
@@ -7297,23 +7300,33 @@ raid5_store_skip_copy(struct mddev *mddev, const char *page, size_t len)
 		return -EINVAL;
 	new = !!new;
 
+	/* q->limits_lock nests outside both, see md_start_sync() */
+	if (!mddev_is_dm(mddev)) {
+		q = mddev->gendisk->queue;
+		lim = queue_limits_start_update(q);
+		limp = &lim;
+	}
+
 	err = mddev_suspend_and_lock(mddev);
-	if (err)
+	if (err) {
+		if (limp)
+			queue_limits_cancel_update(q);
 		return err;
+	}
 	conf = mddev->private;
 	if (!conf)
 		err = -ENODEV;
 	else if (new != conf->skip_copy) {
-		struct request_queue *q = mddev->gendisk->queue;
-		struct queue_limits lim = queue_limits_start_update(q);
-
 		conf->skip_copy = new;
-		if (new)
-			lim.features |= BLK_FEAT_STABLE_WRITES;
-		else
-			lim.features &= ~BLK_FEAT_STABLE_WRITES;
-		err = queue_limits_commit_update(q, &lim);
+		if (limp) {
+			if (new)
+				limp->features |= BLK_FEAT_STABLE_WRITES;
+			else
+				limp->features &= ~BLK_FEAT_STABLE_WRITES;
+		}
 	}
+	if (limp)
+		err = queue_limits_commit_update(q, limp) ?: err;
 	mddev_unlock_and_resume(mddev);
 	return err ?: len;
 }
@@ -8441,7 +8454,8 @@ static int raid5_remove_disk(struct mddev *mddev, struct md_rdev *rdev)
 	return err;
 }
 
-static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev)
+static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev,
+			  struct queue_limits *lim)
 {
 	struct r5conf *conf = mddev->private;
 	int ret, err = -EEXIST;
@@ -8728,7 +8742,7 @@ static int raid5_start_reshape(struct mddev *mddev)
 		rdev_for_each(rdev, mddev)
 			if (rdev->raid_disk < 0 &&
 			    !test_bit(Faulty, &rdev->flags)) {
-				if (raid5_add_disk(mddev, rdev) == 0) {
+				if (raid5_add_disk(mddev, rdev, NULL) == 0) {
 					if (rdev->raid_disk
 					    >= conf->previous_raid_disks)
 						set_bit(In_sync, &rdev->flags);
@@ -8799,7 +8813,7 @@ static void end_reshape(struct r5conf *conf)
 		wake_up(&conf->wait_for_reshape);
 
 		mddev_update_io_opt(conf->mddev,
-			conf->raid_disks - conf->max_degraded);
+			conf->raid_disks - conf->max_degraded, NULL);
 	}
 }
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 4f7905c3412b8..b75e85291e290 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1101,6 +1101,32 @@ queue_limits_start_update(struct request_queue *q)
 	mutex_lock(&q->limits_lock);
 	return q->limits;
 }
+
+/**
+ * queue_limits_start_update_trylock - try to start an atomic update of queue
+ *	limits
+ * @q:		queue to update
+ * @lim:	returns a snapshot of the current limits on success
+ *
+ * Like queue_limits_start_update(), but fails instead of waiting when another
+ * update is in flight.  For callers that must not block on q->limits_lock
+ * because they hold something its current owner is waiting for.
+ *
+ * Context: process context.
+ */
+static inline bool
+queue_limits_start_update_trylock(struct request_queue *q,
+				  struct queue_limits *lim)
+	__cond_acquires(true, &q->limits_lock)
+{
+	if (!mutex_trylock(&q->limits_lock))
+		return false;
+
+	*lim = q->limits;
+
+	return true;
+}
+
 int queue_limits_commit_update_frozen(struct request_queue *q,
 		struct queue_limits *lim) __releases(&q->limits_lock);
 int queue_limits_commit_update(struct request_queue *q,

							input: 14577
							output: 249
							thoughts: 2338

**Patch Evaluation: Uninitialized Memory Risks**

Alright, let's dive into this patch. My primary goal here is to determine if it introduces any new risks related to uninitialized memory access, warranting a KMSAN run. It seems the patch is primarily focused on addressing locking order and deadlock issues within the MD RAID code, particularly around `q->limits_lock` when updating queue limits.

The core of the patch involves changing how `struct queue_limits` is handled. It appears that instead of directly manipulating `q->limits` within critical sections where deadlocks are possible, the patch introduces a local copy (`lim`) of `q->limits` via `queue_limits_start_update()`, which essentially copies the contents. This local copy is then passed to functions like `hot_add_disk`, `remove_and_add_spares`, etc. Crucially, the updates are then committed back via `queue_limits_commit_update()`. If a try lock fails, the functions should return.

I've meticulously reviewed the code, specifically focusing on variable initialization, and the potential for uninitialized memory reads or leaks. I examined the instances where `struct queue_limits lim;` and `struct queue_limits *limp = NULL;` are used across the patched functions. In each instance (`rdev_attr_store`, `md_ioctl`, `md_start_sync`, `check_sb_changes`, `mddev_update_io_opt`, `raid5_store_skip_copy` and `mddev_stack_rdev_into`), `lim` is always initialized *before* it's referenced, primarily by `queue_limits_start_update()`, which returns `q->limits` by value.  Even when a pointer to `lim` is passed, it is initialized. In the instances where the trylock is used, it fails before usage. `mddev_stack_rdev_into` copies the passed-in `lim`. The copy is used.

I see no scenario where uninitialized data is being read or leaked. The patch appears to be a careful refactoring, improving locking and thus reliability. The critical data flow and initialization of the `lim` struct are safe, and there are no copies to user space that are modified.

Considering this analysis, my assessment is that this patch *does not* introduce any new risks related to uninitialized memory. KMSAN is designed to catch specific types of memory errors that are not addressed in this patch.  Given this is a refactor, KASAN, LOCKDEP and other standard bug detectors are the right tools here. Therefore, `NeedsKMSAN` should be set to `false`. I'm confident in this evaluation. Let's flag this as safe.

{
  "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.",
  "NeedsKMSAN": false
}

{
  "KMSANReasoning": "The patch modifies the MD (software RAID) subsystem and block layer helper functions to restructure how queue limits are updated across md-linear, raid1, raid10, and raid5 arrays. Specifically, it passes an existing or newly started `struct queue_limits` through various hot-add/remove/update call paths to avoid lock-inversion deadlocks between `q-\u003elimits_lock`, array suspension, and `reconfig_mutex`.\n\nAll `struct queue_limits` instances on the stack are fully initialized before use (via `queue_limits_start_update()`, which returns `q-\u003elimits` by value, or `queue_limits_start_update_trylock()` which populates `*lim`). No uninitialized data structures or padding bytes are read, passed to control flow, or copied to user space. Potential bugs introduced by these changes are primarily deadlocks, locking order violations, or reference/state errors, which are detectable by LOCKDEP and standard KASAN/kernel debuggers rather than KMSAN. Dedicated KMSAN fuzzing is therefore not warranted.",
  "NeedsKMSAN": false
}

LLM Calls Summary:
Total Calls	Total Tokens	Avg Tokens	Total Duration (Seconds)	Avg Duration (Seconds)

Tool Calls Summary:
Total Calls	Total Duration (Seconds)	Avg Duration (Seconds)