This looks like a use-after-free bug somewhere in drivers/md/raid10.c.

			Pekka

--

[ message continues ]

Does reverting commit 4e78064f42ad474ce9c31760861f7fb0cfc22532 ("md:
Fix possible deadlock with multiple mempool allocations.") fix the
problem?
--

[ message continues ]

i think it's quite easy to reproduce this problem. here's a mini howto:

- setup two raid10 matrices.

[root@odra ~]# cat /proc/mdstat
Personalities : [raid1] [raid0] [raid10]
md3 : active raid10 sdd4[1] sdc4[0]
      424757248 blocks super 1.2 512K chunks 2 far-copies [2/2] [UU]
      [>....................]  resync =  0.4% (1966592/424757248) finish=82.4min speed=85504K/sec

md2 : active raid10 sdb4[1] sda4[0]
      424757248 blocks super 1.2 512K chunks 2 far-copies [2/2] [UU]
      [>....................]  resync =  0.5% (2446080/424757248) finish=97.1min speed=72432K/sec

- stop matrices.

[root@odra ~]# mdadm --stop /dev/md2
mdadm: stopped /dev/md2
[root@odra ~]# mdadm --stop /dev/md3
mdadm: stopped /dev/md3

- create raid0 on devices previously used by raid10.

[root@odra ~]# mdadm -C /dev/md2 -l 0 -n 4 /dev/sda4 /dev/sdb4 /dev/sdc4 /dev/sdd4

mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md2 started.

[root@odra ~]# cat /proc/mdstat
Personalities : [raid1] [raid0] [raid10]
md2 : active raid0 sdd4[3] sdc4[2] sdb4[1] sda4[0]
      1699028992 blocks super 1.2 512k chunks

- stop it.

[root@odra ~]# mdadm --stop /dev/md2
mdadm: stopped /dev/md2

- create one raid10 matrix once more.

[root@odra ~]# mdadm -C /dev/md2 -l 10 -n 2 --layout f2 /dev/sda4 /dev/sdb4
mdadm: Defaulting to version 1.2 metadata
mdadm: array /dev/md2 started.

- in this moment i can see a bug report.

Dec 30 20:08:46 odra kernel: [12501.627162] =============================================================================
Dec 30 20:08:46 odra kernel: [12501.627166] BUG kmalloc-256: Poison overwritten
Dec 30 20:08:46 odra kernel: [12501.627168] -----------------------------------------------------------------------------
Dec 30 20:08:46 odra kernel: [12501.627169]
Dec 30 20:08:46 odra kernel: [12501.627172] INFO: 0xffff8803feb5e15c-0xffff8803feb5e15d. First byte 0x6c instead of 0x6b
Dec 30 20:08:46 odra kernel: [12501.627178] INFO: Allocated in setup_conf+0x12b/0x360 ...
[ message continues ]

Please report exactly which kernel you are running (git hash of head) and in
particular whether
   commit  589a594be1fb8815b3f18e517be696c48664f728

is present?

It looks like something tried to lock conf->device_lock after conf had been
freed.  It is possible that that could happen due to the bug  fixed by the
above commit.

Thanks,
NeilBrown



--

[ message continues ]

i'm testing the pure 2.6.37-rc8 which afaics contains mentioned merge:

 3d0b608 589a594
 Author: Linus Torvalds <torvalds@linux-foundation.org>
 Date:   Tue Dec 14 18:49:40 2010 -0800
     Merge branch 'for-linus' of git://neil.brown.name/md

--

[ message continues ]