Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 14 Jun 2023 07:01:20 -0700
From:   Christoph Hellwig <hch@infradead.org>
To:     "Jain, Ayush" <Ayush.Jain3@amd.com>
Cc:     Christoph Hellwig <hch@infradead.org>,
        "sfr@canb.auug.org.au" <sfr@canb.auug.org.au>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Linux Next Mailing List <linux-next@vger.kernel.org>,
        "Karny, Wyes" <Wyes.Karny@amd.com>, Jens Axboe <axboe@kernel.dk>,
        "linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
        "V, Narasimhan" <Narasimhan.V@amd.com>,
        "Shetty, Kalpana" <Kalpana.Shetty@amd.com>,
        "Shukla, Santosh" <Santosh.Shukla@amd.com>
Subject: Re: Kernel null pointer dereference on stopping raid device
Message-ID: <ZInIMLlMby2aNNr1@infradead.org>
References: <e78344ad-8d57-91d8-0bfb-724c740c7c72@amd.com>
 <3c4911c4-d3d7-a93e-5f14-e97384ae4f21@amd.com>
 <ZIlqvsZ6nMv2OT2u@infradead.org>
 <IA1PR12MB61375A452083D65B5FB815DBBA5AA@IA1PR12MB6137.namprd12.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <IA1PR12MB61375A452083D65B5FB815DBBA5AA@IA1PR12MB6137.namprd12.prod.outlook.com>
Precedence: bulk

On Wed, Jun 14, 2023 at 09:54:07AM +0000, Jain, Ayush wrote:
> Patch applied cleanly on next-20230614 and resolved the issue.
> 
> Reported-by: Ayush Jain <ayush.jain3@amd.com>
> Tested-by: Ayush Jain <ayush.jain3@amd.com>

That was just a quick hack to verify the problem.  I think this is
the proper fix, can you try it as well?

diff --git a/drivers/md/md.c b/drivers/md/md.c
index ca0de7ddd9434d..da523e80a4e990 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -2467,10 +2467,12 @@ static void export_rdev(struct md_rdev *rdev, struct mddev *mddev)
 
 static void md_kick_rdev_from_array(struct md_rdev *rdev)
 {
-	bd_unlink_disk_holder(rdev->bdev, rdev->mddev->gendisk);
+	struct mddev *mddev = rdev->mddev;
+
+	bd_unlink_disk_holder(rdev->bdev, mddev->gendisk);
 	list_del_rcu(&rdev->same_set);
 	pr_debug("md: unbind<%pg>\n", rdev->bdev);
-	mddev_destroy_serial_pool(rdev->mddev, rdev, false);
+	mddev_destroy_serial_pool(mddev, rdev, false);
 	rdev->mddev = NULL;
 	sysfs_remove_link(&rdev->kobj, "block");
 	sysfs_put(rdev->sysfs_state);
@@ -2488,7 +2490,7 @@ static void md_kick_rdev_from_array(struct md_rdev *rdev)
 	INIT_WORK(&rdev->del_work, rdev_delayed_delete);
 	kobject_get(&rdev->kobj);
 	queue_work(md_rdev_misc_wq, &rdev->del_work);
-	export_rdev(rdev, rdev->mddev);
+	export_rdev(rdev, mddev);
 }
 
 static void export_array(struct mddev *mddev)