Re: [PATCH v3] md: remove legacy async del_gendisk

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] md: spurious -EEXIST during concurrent array allocation due to missing synchronization
--

commit 2bbedaa2916a59078e57417858612d10fe4a7cc6
Author: Li Youhong <liyouhong@kylinos.cn>
Subject: md: remove legacy async del_gendisk

This commit removes the legacy async del_gendisk mode and delayed array
deletion. It processes deletions synchronously to avoid lockdep cycles
between major_names_lock, md_misc_wq, and reconfig_mutex.

Closes: https://syzkaller.appspot.com/bug?extid=68e1f51046d68329940f

> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 680b34a63cb3d..fbe302418be97 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c

[ ... ]

> @@ -677,10 +698,15 @@ static bool mddev_put_locked(struct mddev *mddev)
>  
>  void mddev_put(struct mddev *mddev)
>  {
> +	bool complete_delete;
> +
>  	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
>  		return;
>  
> -	__mddev_put(mddev);
> +	complete_delete = __mddev_put(mddev);
>  	spin_unlock(&all_mddevs_lock);
> +	if (complete_delete)
> +		mddev_complete_delete(mddev);
>  }

[Severity: Medium]
Could this create a window where a concurrent array allocation sees the
partially deleted array?

When all_mddevs_lock is dropped here, the mddev is still present in the
all_mddevs list because kobject_put has not yet run via
mddev_complete_delete.

[ ... ]

> @@ -6327,12 +6323,6 @@ struct mddev *md_alloc(dev_t dev, char *name)
>  	int unit;
>  	int error;
>  
> -	/*
> -	 * Wait for any previous instance of this device to be completely
> -	 * removed (mddev_delayed_delete).
> -	 */
> -	flush_workqueue(md_misc_wq);
> -
>  	mutex_lock(&disks_mutex);
>  	mddev = mddev_alloc(dev);
>  	if (IS_ERR(mddev)) {

[Severity: Medium]
Can this missing synchronization lead to spurious -EEXIST or -EBUSY failures
during array creation?

With flush_workqueue removed, if one thread executes mddev_put and is
preempted after dropping all_mddevs_lock but before calling
mddev_complete_delete, a concurrent md_alloc can iterate all_mddevs, find the
partially deleted array (since it does not filter out MD_DELETED devices),
and fail with -EEXIST or later during add_disk.

This might break user-space scripts that rapidly tear down and recreate
arrays, such as testing suites or mdadm.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924081552.2564214-1-dayou5941@163.com?part=1