md-bitmap-bmc-overflow-reproducer.sh

function grow()
{
    local md=$1
    shift

    mdadm --grow --bitmap=none $md
    mdadm --grow --bitmap=internal $md
}
function recreate()
{
    local md=$1
    shift

    mkdir -p /md
    umount /md

    mdadm --stop --scan

    mdadm --zero-superblock -f /dev/sdb
    mdadm --zero-superblock -f /dev/sdc

    mdadm --create $md --metadata 1.2 -f --level=mirror --bitmap=internal --raid-devices=2 /dev/sdb /dev/sdc
    mdadm --wait $md

    read

    mke2fs -t ext4 -FF $md
    mount $md /md || return 1

    yes "" | cat -n | head -n100 | xargs -P10 -n1 -i bash -c 'dd if=/dev/zero of=/md/out.{} count=$((1<<10)) bs=512 oflag=direct' &
    for i in {1..100}; do
        grow $md
    done

    wait
}

function main()
{
    local md=/dev/md1

    dmesg -c > /dev/null
    recreate $md
    sync
}
main "$@"

Example of the trace:

[ 1141.120091] dd              D16368  1894   1678 0x00000000
[ 1141.120417] Call Trace:
[ 1141.120570]  ? __schedule+0x720/0x1f90
[ 1141.120794]  ? __down_trylock_console_sem+0x36/0x80
[ 1141.121093]  ? vprintk_emit+0x1a8/0x4a0
[ 1141.121323]  ? __sched_text_start+0x8/0x8
[ 1141.121562]  ? prepare_to_wait+0x14e/0x330
[ 1141.121803]  ? prepare_to_wait+0xad/0x330
[ 1141.122049]  ? check_flags.part.39+0x420/0x420
[ 1141.122312]  ? do_raw_spin_unlock+0xac/0x310
[ 1141.122564]  ? _raw_spin_unlock_irqrestore+0x2f/0x40
[ 1141.122880]  ? trace_hardirqs_off+0x95/0x200
[ 1141.123146]  ? trace_hardirqs_on+0x210/0x210
[ 1141.123403]  schedule+0xe5/0x390
[ 1141.123597]  ? __schedule+0x1f90/0x1f90
[ 1141.123861]  ? do_raw_spin_unlock+0xac/0x310
[ 1141.124263]  ? do_raw_spin_trylock+0x1b0/0x1b0
[ 1141.124633]  ? trace_hardirqs_on+0x74/0x210
[ 1141.124929]  ? trace_hardirqs_off_caller+0x210/0x210
[ 1141.125302]  md_bitmap_startwrite+0x35a/0x530
[ 1141.125617]  ? md_bitmap_file_set_bit+0x440/0x440
[ 1141.125948]  ? raid1_write_request+0x471/0x2e70
[ 1141.126275]  ? check_flags.part.39+0x420/0x420
[ 1141.126573]  ? mempool_destroy+0x20/0x20
[ 1141.126834]  ? wait_woken+0x1d0/0x1d0
[ 1141.127085]  ? lock_release+0x870/0x870
[ 1141.127345]  ? lock_release+0x870/0x870
[ 1141.127622]  ? lock_release+0x870/0x870
[ 1141.127880]  ? __lock_acquire+0x5270/0x5270
[ 1141.128173]  raid1_write_request+0xb08/0x2e70
...
[ 1141.171381] mdadm           D22352  1908   1610 0x00000000
[ 1141.171703] Call Trace:
[ 1141.171853]  ? __schedule+0x720/0x1f90
[ 1141.172083]  ? __sched_text_start+0x8/0x8
[ 1141.172318]  ? trace_hardirqs_off_caller+0x210/0x210
[ 1141.172611]  ? prepare_to_wait_event+0x309/0x770
[ 1141.172904]  ? prepare_to_wait_exclusive+0x300/0x300
[ 1141.173264]  ? trace_hardirqs_on+0x74/0x210
[ 1141.173558]  ? trace_hardirqs_off_caller+0x210/0x210
[ 1141.173910]  ? __wait_rcu_gp+0x24f/0x3e0
[ 1141.174201]  schedule+0xe5/0x390
[ 1141.174427]  ? __schedule+0x1f90/0x1f90
[ 1141.174702]  ? __wake_up_common+0x6e0/0x6e0
[ 1141.174977]  ? rcu_unexpedite_gp+0x20/0x20
[ 1141.175220]  ? __d_lookup_rcu+0x3a2/0xc00
[ 1141.175457]  mddev_suspend+0x394/0x550
[ 1141.175678]  ? mdstat_poll+0x1b0/0x1b0
[ 1141.175898]  ? wait_woken+0x1d0/0x1d0
[ 1141.176130]  ? selinux_ipv4_output+0x30/0x30
[ 1141.176385]  ? security_capable+0x4f/0x90
[ 1141.176623]  md_ioctl+0x553b/0x61c0

(gdb) l *(md_bitmap_startwrite+0x35a)
0xffffffff82c3365a is in md_bitmap_startwrite (md-bitmap.c:1437).
1432                             */
1433                            prepare_to_wait(&bitmap->overflow_wait, &__wait,
1434                                            TASK_UNINTERRUPTIBLE);
1435                            spin_unlock_irq(&bitmap->counts.lock);
1436                            schedule();
1437                            finish_wait(&bitmap->overflow_wait, &__wait);
1438                            continue;
1439                    }