[PATCH 1/3] md/raid0: reject a takeover whose zones cannot cover the array

[Zizhi Wo]

From: Zizhi Wo <wozizhi@xxxxxxxxxx>

If a raid0 takeover builds strip zones that cover less than the advertised
array size, the block layer still accepts I/O for the whole size.
raid0_make_request() hands any request past the zones to the mapping code,
which fails to map it and triggers a BUG_ON.

The zones are built from the member sizes in rdev->sectors, which may not
match the size the array already advertises, so the zones can come out
covering less than it. The extreme case is a member with no size recorded
at all: an array created without metadata imports its devices through
md_import_device(dev, -1, -1), which never sets rdev->sectors, and
bind_rdev_to_array() does not reject such a member either, because its
check that mddev->dev_sectors fits inside a member is skipped when
rdev->sectors is zero.

Refuse a raid0 takeover when its zones cannot cover the size the gendisk
advertises. This prevents the takeover from silently shrinking the array,
mirroring the rule raid5_start_reshape() and raid10_start_reshape() apply
to a reshape.

Fixes: 9af204cf720c ("md: Add support for Raid5->Raid0 and Raid10->Raid0 takeover")
Fixes: fc3a08b85b7a ("Add raid1->raid0 takeover support")
Signed-off-by: Zizhi Wo <wozizhi@xxxxxxxxxx>
---
 drivers/md/raid0.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 35e103f0c2c3..fccc62a5fecc 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -641,10 +641,38 @@ static void raid0_error(struct mddev *mddev, struct md_rdev *rdev)
 		pr_crit("md/raid0%s: Disk failure on %pg detected, failing array.\n",
 			md_name, rdev->bdev);
 	}
 }
 
+/*
+ * Refuse a takeover whose strip zones cannot cover the capacity the gendisk
+ * advertises: raid0 derives those zones from the sizes of its members, so
+ * find_zone() cannot map I/O that falls beyond them.
+ */
+static int raid0_takeover_check(struct mddev *mddev, int chunk)
+{
+	sector_t capacity = get_capacity(mddev->gendisk);
+	sector_t coverage = 0;
+	struct md_rdev *rdev;
+
+	rdev_for_each(rdev, mddev) {
+		sector_t sectors = rdev->sectors;
+
+		sector_div(sectors, chunk);
+		coverage += sectors * chunk;
+	}
+
+	if (coverage < capacity) {
+		pr_warn("md/raid0:%s: refusing takeover, zones cover only %llu of %llu sectors\n",
+			mdname(mddev), (unsigned long long)coverage,
+			(unsigned long long)capacity);
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static void *raid0_takeover_raid45(struct mddev *mddev)
 {
 	struct md_rdev *rdev;
 	struct r0conf *priv_conf;
 
@@ -663,10 +691,13 @@ static void *raid0_takeover_raid45(struct mddev *mddev)
 			return ERR_PTR(-EINVAL);
 		}
 		rdev->sectors = mddev->dev_sectors;
 	}
 
+	if (raid0_takeover_check(mddev, mddev->chunk_sectors))
+		return ERR_PTR(-EINVAL);
+
 	/* Set new parameters */
 	mddev->new_level = 0;
 	mddev->new_layout = 0;
 	mddev->new_chunk_sectors = mddev->chunk_sectors;
 	mddev->raid_disks--;
@@ -705,10 +736,13 @@ static void *raid0_takeover_raid10(struct mddev *mddev)
 		pr_warn("md/raid0:%s: All mirrors must be already degraded!\n",
 			mdname(mddev));
 		return ERR_PTR(-EINVAL);
 	}
 
+	if (raid0_takeover_check(mddev, mddev->chunk_sectors))
+		return ERR_PTR(-EINVAL);
+
 	/* Set new parameters */
 	mddev->new_level = 0;
 	mddev->new_layout = 0;
 	mddev->new_chunk_sectors = mddev->chunk_sectors;
 	mddev->delta_disks = - mddev->raid_disks / 2;
@@ -748,10 +782,13 @@ static void *raid0_takeover_raid1(struct mddev *mddev)
 
 	if ((chunksect << 9) < PAGE_SIZE)
 		/* array size does not allow a suitable chunk size */
 		return ERR_PTR(-EINVAL);
 
+	if (raid0_takeover_check(mddev, chunksect))
+		return ERR_PTR(-EINVAL);
+
 	/* Set new parameters */
 	mddev->new_level = 0;
 	mddev->new_layout = 0;
 	mddev->new_chunk_sectors = chunksect;
 	mddev->chunk_sectors = chunksect;
-- 
2.52.0