In the Linux kernel, the following vulnerability has been resolved:

md/raid5: fix soft lockup in retryalignedread()

When retryalignedread() encounters an overlapped stripe, it releases the stripe via raid5releasestripe() which puts it on the lockless releasedstripes llist. In the next raid5d loop iteration, releasestripelist() drains the stripe onto handlelist (since STRIPEHANDLE is set by the original IO), but retryalignedread() runs before handleactivestripes() and removes the stripe from handlelist via findgetstripe() -> listdelinit(). This prevents handlestripe() from ever processing the stripe to resolve the overlap, causing an infinite loop and soft lockup.

Fix this by using releasestripe() with tempinactivelist instead of raid5releasestripe() in the failure path, so the stripe does not go through the releasedstripes llist. This allows raid5d to break out of its loop, and the overlap will be resolved when the stripe is eventually processed by handlestripe().

In the Linux kernel, the following vulnerability has been resolved:

md/raid5: fix IO hang with degraded array with llbitmap

When llbitmap bit state is still unwritten, any new write should force rcw, as bitmapops->blockssynced() is checked in handlestripedirtying(). However, later the same check is missing in needthisblock(), causing stripe to deadloop during handling because handlestripe() will decide to go to handlestripefill(), meanwhile needthisblock() always return 0 and nothing is handled.