* Re: [PATCH] md: fix create on open mddev lifetime regression
2025-07-30 7:33 [PATCH] md: fix create on open mddev lifetime regression Yu Kuai
@ 2025-07-30 7:46 ` Paul Menzel
2025-07-30 7:56 ` Xiao Ni
2025-07-30 18:20 ` Yu Kuai
2 siblings, 0 replies; 4+ messages in thread
From: Paul Menzel @ 2025-07-30 7:46 UTC (permalink / raw)
To: Yu Kuai
Cc: contact, hdanton, song, yukuai3, xni, linux-raid, linux-kernel,
yi.zhang, yangerkun, johnny.chenyi
Dear Kuai,
Thank you for your patch and tracking this down.
Am 30.07.25 um 09:33 schrieb Yu Kuai:
> From: Yu Kuai <yukuai3@huawei.com>
>
> Commit 9e59d609763f ("md: call del_gendisk in control path") move
move*s*
> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
>
> 1) open
>
> md_probe
> md_alloc_and_put
> md_alloc
> mddev_alloc
> atomic_set(&mddev->active, 1);
> mddev->hold_active = UNTIL_IOCTL
> mddev_put
> atomic_dec_and_test(&mddev->active)
> if (mddev->hold_active)
> -> active is 0, hold_active is set
> md_open
> mddev_get
> atomic_inc(&mddev->active);
>
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
>
> md_ioctl
> mddev->hold_active = 0
>
> 3) close
>
> md_release
> mddev_put(mddev);
> atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
> __mddev_put
> -> hold_active is cleared, mddev will be freed
> queue_work(md_misc_wq, &mddev->del_work)
>
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
>
> Fix this problem by setting MD_DELETED before queuing del_work.
>
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
> drivers/md/md.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
> mddev->ctime || mddev->hold_active)
> return;
>
> + /*
> + * If array is freed by stopping array, MD_DELETED is set by
> + * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
in case
> + * directly by closing a mddev that is created by create_on_open.
> + */
> + set_bit(MD_DELETED, &mddev->flags);
> /*
> * Call queue_work inside the spinlock so that flush_workqueue() after
> * mddev_find will succeed in waiting for the work to be done.
With the changes above:
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Kind regards,
Paul
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] md: fix create on open mddev lifetime regression
2025-07-30 7:33 [PATCH] md: fix create on open mddev lifetime regression Yu Kuai
2025-07-30 7:46 ` Paul Menzel
@ 2025-07-30 7:56 ` Xiao Ni
2025-07-30 18:20 ` Yu Kuai
2 siblings, 0 replies; 4+ messages in thread
From: Xiao Ni @ 2025-07-30 7:56 UTC (permalink / raw)
To: Yu Kuai
Cc: contact, hdanton, song, yukuai3, linux-raid, linux-kernel,
yi.zhang, yangerkun, johnny.chenyi
On Wed, Jul 30, 2025 at 3:40 PM Yu Kuai <yukuai1@huaweicloud.com> wrote:
>
> From: Yu Kuai <yukuai3@huawei.com>
>
> Commit 9e59d609763f ("md: call del_gendisk in control path") move
> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
>
> 1) open
>
> md_probe
> md_alloc_and_put
> md_alloc
> mddev_alloc
> atomic_set(&mddev->active, 1);
> mddev->hold_active = UNTIL_IOCTL
> mddev_put
> atomic_dec_and_test(&mddev->active)
> if (mddev->hold_active)
> -> active is 0, hold_active is set
> md_open
> mddev_get
> atomic_inc(&mddev->active);
>
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
>
> md_ioctl
> mddev->hold_active = 0
>
> 3) close
>
> md_release
> mddev_put(mddev);
> atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
> __mddev_put
> -> hold_active is cleared, mddev will be freed
> queue_work(md_misc_wq, &mddev->del_work)
>
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
>
> Fix this problem by setting MD_DELETED before queuing del_work.
>
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
> drivers/md/md.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
> mddev->ctime || mddev->hold_active)
> return;
>
> + /*
> + * If array is freed by stopping array, MD_DELETED is set by
> + * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
> + * directly by closing a mddev that is created by create_on_open.
> + */
> + set_bit(MD_DELETED, &mddev->flags);
> /*
> * Call queue_work inside the spinlock so that flush_workqueue() after
> * mddev_find will succeed in waiting for the work to be done.
> --
> 2.39.2
>
Hi Kuai
Thanks for figuring out this problem so quicily.
Looks good to me
Reviewed-by: Xiao Ni <xni@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] md: fix create on open mddev lifetime regression
2025-07-30 7:33 [PATCH] md: fix create on open mddev lifetime regression Yu Kuai
2025-07-30 7:46 ` Paul Menzel
2025-07-30 7:56 ` Xiao Ni
@ 2025-07-30 18:20 ` Yu Kuai
2 siblings, 0 replies; 4+ messages in thread
From: Yu Kuai @ 2025-07-30 18:20 UTC (permalink / raw)
To: Yu Kuai, contact, hdanton, song, yukuai3, xni
Cc: linux-raid, linux-kernel, yi.zhang, yangerkun, johnny.chenyi
在 2025/7/30 15:33, Yu Kuai 写道:
> From: Yu Kuai <yukuai3@huawei.com>
>
> Commit 9e59d609763f ("md: call del_gendisk in control path") move
> setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the
> case create on open, mddev can be freed without do_md_stop():
>
> 1) open
>
> md_probe
> md_alloc_and_put
> md_alloc
> mddev_alloc
> atomic_set(&mddev->active, 1);
> mddev->hold_active = UNTIL_IOCTL
> mddev_put
> atomic_dec_and_test(&mddev->active)
> if (mddev->hold_active)
> -> active is 0, hold_active is set
> md_open
> mddev_get
> atomic_inc(&mddev->active);
>
> 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO:
>
> md_ioctl
> mddev->hold_active = 0
>
> 3) close
>
> md_release
> mddev_put(mddev);
> atomic_dec_and_lock(&mddev->active, &all_mddevs_lock)
> __mddev_put
> -> hold_active is cleared, mddev will be freed
> queue_work(md_misc_wq, &mddev->del_work)
>
> Now that MD_DELETED is not set, before mddev is freed by
> mddev_delayed_delete(), md_open can still succeed and break mddev
> lifetime, causing mddev->kobj refcount underflow or mddev uaf
> problem.
>
> Fix this problem by setting MD_DELETED before queuing del_work.
>
> Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/
> Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Signed-off-by: Yu Kuai <yukuai3@huawei.com>
> ---
> drivers/md/md.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 046fe85c76fe..5289dcc3a6af 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -636,6 +636,12 @@ static void __mddev_put(struct mddev *mddev)
> mddev->ctime || mddev->hold_active)
> return;
>
> + /*
> + * If array is freed by stopping array, MD_DELETED is set by
> + * do_md_stop(), MD_DELETED is still set here in cause mddev is freed
> + * directly by closing a mddev that is created by create_on_open.
> + */
> + set_bit(MD_DELETED, &mddev->flags);
> /*
> * Call queue_work inside the spinlock so that flush_workqueue() after
> * mddev_find will succeed in waiting for the work to be done.
Applied to md-6.17 with typo fixed.
Thanks
^ permalink raw reply [flat|nested] 4+ messages in thread