[PATCH v2] md: stop sync_work in md_stop() before clearing pers

[Li Youhong]

From: Li Youhong <liyouhong@xxxxxxxxxx>

dm-raid tears down arrays via md_stop(), which clears mddev->pers
without waiting for previously queued sync_work. This work may
then call remove_spares() with pers == NULL, or continue accessing
mddev after raid_dtr() frees it.

do_md_stop()/md_stop_writes() already call stop_sync_thread()
before teardown. Do the same in md_stop() so sync_work finishes
before pers is cleared.

Fixes: db5e653d7c9f ("md: delay choosing sync action to md_start_sync()")
Reported-by: syzbot+a53c2918175b36cfd601@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=a53c2918175b36cfd601
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Li Youhong <liyouhong@xxxxxxxxxx>
---
v2:
- Drop the pers NULL check in md_start_sync().
- Call stop_sync_thread() from md_stop() before clearing pers,
  matching do_md_stop()/md_stop_writes().
- v1: link: https://lore.kernel.org/linux-raid/20261106083543.249267-1-dayou5941@xxxxxxx

 drivers/md/md.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..eaa20ecafbf7 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7101,6 +7101,14 @@ void md_stop(struct mddev *mddev)
 {
 	lockdep_assert_held(&mddev->reconfig_mutex);
 
+	/*
+	 * md_check_recovery() may have queued sync_work; that work accesses
+	 * pers. Wait for it here before __md_stop() clears pers, as
+	 * do_md_stop()/md_stop_writes() do.
+	 */
+	set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	stop_sync_thread(mddev, true);
+
 	/* stop the array and free an attached data structures.
 	 * This is called from dm-raid
 	 */
-- 
2.25.1