[PATCH] md: fix create on open mddev lifetime regression

[PATCH] md: fix create on open mddev lifetime regression

[Yu Kuai]

From: Yu Kuai <yukuai3@huawei.com>

Commit 9e59d609763f ("md: call del_gendisk in control path") move
setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
case create on open, mddev can be freed without do_md_stop():

1) open

md_probe
 md_alloc_and_put
  md_alloc
   mddev_alloc
   atomic_set(&mddev->active, 1);
   mddev->hold_active = UNTIL_IOCTL
  mddev_put
   atomic_dec_and_test(&mddev->active)
    if (mddev->hold_active)
    -> active is 0, hold_active is set
md_open
 mddev_get
  atomic_inc(&mddev->active);

2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:

md_ioctl
 mddev->hold_active = 0

3) close

md_release
 mddev_put(mddev);
  atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
  __mddev_put
  -> hold_active is cleared, mddev will be freed
  queue_work(md_misc_wq, &mddev->del_work)

Now that MD_DELETED is not set, before mddev is freed by
mddev_delayed_delete(), md_open can still succeed and break mddev
lifetime, causing mddev->kobj refcount underflow or mddev uaf
problem.

Fix this problem by setting MD_DELETED before queuing del_work.

Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
Fixes: 9e59d609763f ("md: call del_gendisk in control path")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
 drivers/md/md.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 046fe85c76fe..5289dcc3a6af 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
 	    mddev->ctime || mddev->hold_active)
 		return;
 
+	/*
+	 * If array is freed by stopping array, MD_DELETED is set by
+	 * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
+	 * directly by closing a mddev that is created by create_on_open.
+	 */
+	set_bit(MD_DELETED, &mddev->flags);
 	/*
 	 * Call queue_work inside the spinlock so that flush_workqueue() after
 	 * mddev_find will succeed in waiting for the work to be done.
-- 
2.39.2

Re: [PATCH] md: fix create on open mddev lifetime regression

[Paul Menzel]

Dear Kuai,


Thank you for your patch and tracking this down.

Am 30.07.25 um 09:33 schrieb Yu Kuai:
> From: Yu Kuai <yukuai3@huawei.com>
> 
> Commit 9e59d609763f ("md: call del_gendisk in control path") move

move*s*

> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
> 
> 1) open
> 
> md_probe
>   md_alloc_and_put
>    md_alloc
>     mddev_alloc
>     atomic_set(&mddev->active, 1);
>     mddev->hold_active = UNTIL_IOCTL
>    mddev_put
>     atomic_dec_and_test(&mddev->active)
>      if (mddev->hold_active)
>      -> active is 0, hold_active is set
> md_open
>   mddev_get
>    atomic_inc(&mddev->active);
> 
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
> 
> md_ioctl
>   mddev->hold_active = 0
> 
> 3) close
> 
> md_release
>   mddev_put(mddev);
>    atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
>    __mddev_put
>    -> hold_active is cleared, mddev will be freed
>    queue_work(md_misc_wq, &mddev->del_work)
> 
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
> 
> Fix this problem by setting MD_DELETED before queuing del_work.
> 
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
>   drivers/md/md.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
>   	    mddev->ctime || mddev->hold_active)
>   		return;
>   
> +	/*
> +	 * If array is freed by stopping array, MD_DELETED is set by
> +	 * do_md_stop(), MD_DELETED is still set here in cause mddev is freed

in case

> +	 * directly by closing a mddev that is created by create_on_open.
> +	 */
> +	set_bit(MD_DELETED, &mddev->flags);
>   	/*
>   	 * Call queue_work inside the spinlock so that flush_workqueue() after
>   	 * mddev_find will succeed in waiting for the work to be done.

With the changes above:

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul

Re: [PATCH] md: fix create on open mddev lifetime regression

[Xiao Ni]

On Wed, Jul 30, 2025 at 3:40 PM Yu Kuai <yukuai1@huaweicloud.com> wrote:
>
> From: Yu Kuai <yukuai3@huawei.com>
>
> Commit 9e59d609763f ("md: call del_gendisk in control path") move
> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
>
> 1) open
>
> md_probe
>  md_alloc_and_put
>   md_alloc
>    mddev_alloc
>    atomic_set(&mddev->active, 1);
>    mddev->hold_active = UNTIL_IOCTL
>   mddev_put
>    atomic_dec_and_test(&mddev->active)
>     if (mddev->hold_active)
>     -> active is 0, hold_active is set
> md_open
>  mddev_get
>   atomic_inc(&mddev->active);
>
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
>
> md_ioctl
>  mddev->hold_active = 0
>
> 3) close
>
> md_release
>  mddev_put(mddev);
>   atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
>   __mddev_put
>   -> hold_active is cleared, mddev will be freed
>   queue_work(md_misc_wq, &mddev->del_work)
>
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
>
> Fix this problem by setting MD_DELETED before queuing del_work.
>
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
>  drivers/md/md.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
>             mddev->ctime || mddev->hold_active)
>                 return;
>
> +       /*
> +        * If array is freed by stopping array, MD_DELETED is set by
> +        * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
> +        * directly by closing a mddev that is created by create_on_open.
> +        */
> +       set_bit(MD_DELETED, &mddev->flags);
>         /*
>          * Call queue_work inside the spinlock so that flush_workqueue() after
>          * mddev_find will succeed in waiting for the work to be done.
> --
> 2.39.2
>
Hi Kuai

Thanks for figuring out this problem so quicily.

Looks good to me
Reviewed-by: Xiao Ni <xni@redhat.com>

Re: [PATCH] md: fix create on open mddev lifetime regression

[Yu Kuai]

在 2025/7/30 15:33, Yu Kuai 写道:
> From: Yu Kuai <yukuai3@huawei.com>
>
> Commit 9e59d609763f ("md: call del_gendisk in control path") move
> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
>
> 1) open
>
> md_probe
>   md_alloc_and_put
>    md_alloc
>     mddev_alloc
>     atomic_set(&mddev->active, 1);
>     mddev->hold_active = UNTIL_IOCTL
>    mddev_put
>     atomic_dec_and_test(&mddev->active)
>      if (mddev->hold_active)
>      -> active is 0, hold_active is set
> md_open
>   mddev_get
>    atomic_inc(&mddev->active);
>
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
>
> md_ioctl
>   mddev->hold_active = 0
>
> 3) close
>
> md_release
>   mddev_put(mddev);
>    atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
>    __mddev_put
>    -> hold_active is cleared, mddev will be freed
>    queue_work(md_misc_wq, &mddev->del_work)
>
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
>
> Fix this problem by setting MD_DELETED before queuing del_work.
>
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
>   drivers/md/md.c | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
>   	    mddev->ctime || mddev->hold_active)
>   		return;
>   
> +	/*
> +	 * If array is freed by stopping array, MD_DELETED is set by
> +	 * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
> +	 * directly by closing a mddev that is created by create_on_open.
> +	 */
> +	set_bit(MD_DELETED, &mddev->flags);
>   	/*
>   	 * Call queue_work inside the spinlock so that flush_workqueue() after
>   	 * mddev_find will succeed in waiting for the work to be done.
Applied to md-6.17 with typo fixed.
Thanks