Re: [PATCH 6.1 2/2] md: fix mddev uaf while iterating all_mddevs list

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: 8542870237c3a48ff049b6c5df5f50c8728284fa

WARNING: Author mismatch between patch and upstream commit:
Backport author: Yu Kuai<yukuai1@huaweicloud.com>
Commit author: Yu Kuai<yukuai3@huawei.com>

Status in newer kernel trees:
6.14.y | Present (different SHA1: 5462544ccbad)
6.13.y | Not found
6.12.y | Not found
6.6.y | Not found

Note: The patch differs from the upstream commit:
---
1:  8542870237c3a ! 1:  dd49667d64662 md: fix mddev uaf while iterating all_mddevs list
    @@ Metadata
      ## Commit message ##
         md: fix mddev uaf while iterating all_mddevs list
     
    +    commit 8542870237c3a48ff049b6c5df5f50c8728284fa upstream.
    +
         While iterating all_mddevs list from md_notify_reboot() and md_exit(),
         list_for_each_entry_safe is used, and this can race with deletint the
         next mddev, causing UAF:
    @@ Commit message
         Closes: https://lore.kernel.org/all/Z7Y0SURoA8xwg7vn@bender.morinfr.org/
         Signed-off-by: Yu Kuai <yukuai3@huawei.com>
         Reviewed-by: Christoph Hellwig <hch@lst.de>
    +    [skip md_seq_show() that is not exist]
    +    Signed-off-by: Yu Kuai <yukuai3@huawei.com>
     
      ## drivers/md/md.c ##
     @@ drivers/md/md.c: static void __mddev_put(struct mddev *mddev)
    @@ drivers/md/md.c: static void __mddev_put(struct mddev *mddev)
      void mddev_put(struct mddev *mddev)
      {
      	if (!atomic_dec_and_lock(&mddev->active, &all_mddevs_lock))
    -@@ drivers/md/md.c: static int md_seq_show(struct seq_file *seq, void *v)
    - 	if (mddev == list_last_entry(&all_mddevs, struct mddev, all_mddevs))
    - 		status_unused(seq);
    - 
    --	if (atomic_dec_and_test(&mddev->active))
    --		__mddev_put(mddev);
    --
    -+	mddev_put_locked(mddev);
    - 	return 0;
    - }
    - 
     @@ drivers/md/md.c: EXPORT_SYMBOL_GPL(rdev_clear_badblocks);
      static int md_notify_reboot(struct notifier_block *this,
      			    unsigned long code, void *x)
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y        |  Success    |  Success   |