Re: [BUG] possible race between md_free_disk and md_notify_reboot

From: Yu Kuai
Date: Fri Feb 21 2025 - 20:08:41 EST


Hi,

在 2025/02/21 23:19, Guillaume Morin 写道:
2) Instead of mddev_free() being called for mddev N+1 like in 1, I wonder
what's preventing mddev_free() being called for mddev N (the one we're
iterating about). Something like

CPU1 CPU2
list_for_each_entry(mddev, &all_mddevs, all_mddevs) {
if (!mddev_get(mddev))
continue;
spin_unlock(&all_mddevs_lock);
mddev_free(mddev) (same mddev as CPU1)

mddev_free() does not check the active atomic, or acquire the
reconfig_mutex/md_lock and will kfree() mddev. So the loop execution
on CPU1 after spin_unlock() could be a UAF.

So I was wondering if you could clarify what is preventing race 2?
i.e what is preventing mddev_free(mddev) from being calling kfree(mddev)
while the md_notify_reboot() loop is handling mddev.

I said already, please take a look how mddev_put() works, mddev_free()
can't be called untill the reference is released after mddev_get().

Thanks,
Kuai