linux-raid.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Christoph Hellwig <hch@lst.de>
To: Song Liu <song@kernel.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>,
	linux-raid@vger.kernel.org,
	syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Subject: [PATCH 1/5] md: fix a lock order reversal in md_alloc
Date: Wed,  1 Sep 2021 13:38:29 +0200	[thread overview]
Message-ID: <20210901113833.1334886-2-hch@lst.de> (raw)
In-Reply-To: <20210901113833.1334886-1-hch@lst.de>

Commit b0140891a8cea3 ("md: Fix race when creating a new md device.")
not only moved assigning mddev->gendisk before calling add_disk, which
fixes the races described in the commit log, but also added a
mddev->open_mutex critical section over add_disk and creation of the
md kobj.  Adding a kobject after add_disk is racy vs deleting the gendisk
right after adding it, but md already prevents against that by holding
a mddev->active reference.

On the other hand taking this lock added a lock order reversal with what
is not disk->open_mutex (used to be bdev->bd_mutex when the commit was
added) for partition devices, which need that lock for the internal open
for the partition scan, and a recent commit also takes it for
non-partitioned devices, leading to further lockdep splatter.

Fixes: b0140891a8ce ("md: Fix race when creating a new md device.")
Fixes: d62633873590 ("block: support delayed holder registration")
Reported-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
---
 drivers/md/md.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index ae8fe54ea3581..6c0c3d0d905aa 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5700,10 +5700,6 @@ static int md_alloc(dev_t dev, char *name)
 	disk->flags |= GENHD_FL_EXT_DEVT;
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
-	/* As soon as we call add_disk(), another thread could get
-	 * through to md_open, so make sure it doesn't get too far
-	 */
-	mutex_lock(&mddev->open_mutex);
 	add_disk(disk);
 
 	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
@@ -5718,7 +5714,6 @@ static int md_alloc(dev_t dev, char *name)
 	if (mddev->kobj.sd &&
 	    sysfs_create_group(&mddev->kobj, &md_bitmap_group))
 		pr_debug("pointless warning\n");
-	mutex_unlock(&mddev->open_mutex);
  abort:
 	mutex_unlock(&disks_mutex);
 	if (!error && mddev->kobj.sd) {
-- 
2.30.2


  reply	other threads:[~2021-09-01 11:40 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-01 11:38 fix a lock order reversal in md_alloc Christoph Hellwig
2021-09-01 11:38 ` Christoph Hellwig [this message]
2021-09-03  6:08   ` [PATCH 1/5] md: " Guoqing Jiang
2021-09-03  7:48     ` NeilBrown
2021-09-01 11:38 ` [PATCH 2/5] md: add error handling support for add_disk() Christoph Hellwig
2021-09-01 11:38 ` [PATCH 3/5] md: add the bitmap group to the default groups for the md kobject Christoph Hellwig
2021-09-01 11:38 ` [PATCH 4/5] md: extend disks_mutex coverage Christoph Hellwig
2021-09-01 11:38 ` [PATCH 5/5] md: properly unwind when failing to add the kobject in md_alloc Christoph Hellwig
2021-09-02  5:06 ` fix a lock order reversal " Song Liu
2021-09-04  1:48 ` Luis Chamberlain
2021-09-09  6:14 ` Song Liu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210901113833.1334886-2-hch@lst.de \
    --to=hch@lst.de \
    --cc=linux-raid@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=song@kernel.org \
    --cc=syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).