Technical Root Cause Analysis

Involved Functions, Structs, and Files

• drivers/md/dm-raid.c: raid_ctr(), raid_preresume(), rs_start_reshape(), raid_resume()
• drivers/md/raid10.c: raid10_start_reshape()
• drivers/md/md.h / drivers/md/md.c: struct mddev, fields recovery and flags, flags MD_RECOVERY_FROZEN and RT_FLAG_RS_SUSPENDED

Mechanism and Invariant Violation

1. dm-raid Frozen State Invariant: In dm-raid, the MD array lifecycle requires that the MD sync thread remain frozen whenever the RAID set is suspended.

   • When a target is constructed in raid_ctr(), RT_FLAG_RS_SUSPENDED is set on rs->runtime_flags, and md_frozen_sync_thread(&rs->md) is invoked, setting MD_RECOVERY_FROZEN on rs->md.recovery.
   • Likewise, during raid_postsuspend(), md_stop_writes() sets MD_RECOVERY_FROZEN while RT_FLAG_RS_SUSPENDED is marked.
   • When the device-mapper target is subsequently resumed via dm_table_resume_targets(), it executes raid_preresume() followed by raid_resume(). In raid_resume(), the kernel asserts this invariant:

     if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) {
         ...
         mddev_lock_nointr(mddev);
         WARN_ON_ONCE(!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery));
         ...
         md_unfrozen_sync_thread(mddev);
         mddev_unlock_and_resume(mddev);
     }
     

2. Triggering Reshape Failure in raid_preresume(): During raid_preresume(), dirty region bitmap loading (__load_dirty_region_bitmap()) is performed. If a reshape was requested (RT_FLAG_RESHAPE_RS set), raid_preresume() proceeds to initiate reshape:

   if (test_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) {
       rs_set_rdev_sectors(rs);
       mddev_lock_nointr(mddev);
       r = rs_start_reshape(rs);
       mddev_unlock(mddev);
       if (r)
           DMWARN("Failed to check/start reshape, continuing without change");
       r = 0;
   }
   

   rs_start_reshape() calls the personality's pers->start_reshape(mddev), which is raid10_start_reshape() for RAID10.

3. Indiscriminate Zeroing of mddev->recovery: Inside raid10_start_reshape() (drivers/md/raid10.c), if an error is encountered while preparing the reshape (such as when resizing the dirty region bitmap via mddev->bitmap_ops->resize() when mddev->delta_disks && mddev->bitmap), the function jumps to the abort: error recovery label:

   abort:
       mddev->recovery = 0;
       spin_lock_irq(&conf->device_lock);
       ...
       spin_unlock_irq(&conf->device_lock);
       mempool_destroy(new_pool);
       return ret;
   

   Resetting mddev->recovery = 0; indiscriminately wipes all recovery flags, including MD_RECOVERY_FROZEN (as well as MD_RECOVERY_WAIT set by rs_start_reshape()).

4. Manifestation of Warning in raid_resume(): When raid10_start_reshape() returns the error code ret, rs_start_reshape() propagates it back to raid_preresume(). In raid_preresume(), dm-raid catches the error and deliberately resets r = 0 to allow the device resume sequence to continue without reshape ("continuing without change").

   However, because raid10_start_reshape() cleared mddev->recovery = 0, MD_RECOVERY_FROZEN is now missing while RT_FLAG_RS_SUSPENDED remains set. dm_table_resume_targets() immediately invokes raid_resume(), where the assertion check:

   WARN_ON_ONCE(!test_bit(MD_RECOVERY_FROZEN, &mddev->recovery));
   

   evaluates to true and trips the warning.