Re: [PATCH] md: don't hand out the array before md_alloc() has added mddev->kobj

[Logan Gunthorpe]

On 2026-10-03 23:57, Yogesh Gaur wrote:
> md_alloc() publishes the gendisk before it is done setting the mddev up:
> 
> 	disk->private_data = mddev;
> 	...
> 	error = add_disk(disk);
> 	if (error)
> 		goto out_put_disk;
> 
> 	kobject_init(&mddev->kobj, &md_ktype);
> 	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
> 
> add_disk() makes /dev/mdN openable, and md_open() only refuses the open
> when MD_CLOSING is set.  mddev comes from mddev_alloc() and is zeroed,
> so anything that gets in between add_disk() and kobject_add() sees an
> mddev->kobj that has never been through kobject_init() - no ktype, no
> kref, state_initialized clear.
> 
> syzbot opens the array in that window and issues ADD_NEW_DISK:
> 
>   kobject: '(null)' (ffff8880120640f0): is not initialized, yet kobject_get() is being called.
>   WARNING: lib/kobject.c:642 at kobject_add_internal+0xea/0xcd0 lib/kobject.c:225
>    kobject_add_varg lib/kobject.c:374 [inline]
>    kobject_add+0x163/0x240 lib/kobject.c:426
>    bind_rdev_to_array+0x80c/0xdd0 drivers/md/md.c:2621
>    md_add_new_disk+0xe3b/0x1850 drivers/md/md.c:7684
>    md_ioctl+0x200a/0x2610 drivers/md/md.c:8499
> 
> bind_rdev_to_array() is not the only way in.  md_run() calls
> sysfs_create_group(&mddev->kobj, &md_redundancy_group), and
> internal_create_group() has its own WARN_ON(!kobj->sd), so RUN_ARRAY in
> the same window warns too.  Guarding the individual callers would mean
> finding all of them; the window itself is what should not be reachable.
> 
> Refuse the open until md_alloc() has added the kobject.  mddev->kobj.sd
> is NULL until kobject_add() creates the directory, and stays set for the
> rest of the mddev's life: commit ca39f7502425 ("md: fix mddev->kobj
> lifetime") dropped the explicit kobject_del() and lets the final put do
> the removal.  md.c already tests mddev->kobj.sd for "is this array
> published yet" in mddev_unlock() and md_run().
> 
> This cannot deadlock against add_disk() itself: device_add_disk() only
> opens the disk to scan partitions when get_capacity(disk) is non-zero,
> and md_alloc() does not set the capacity - md_run() does, long after.
> 
> Fixes: ca39f7502425 ("md: fix mddev->kobj lifetime")
> Reported-by: syzbot+95eeb4ada2349a2170ea@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=95eeb4ada2349a2170ea
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM

This makes sense to me, thanks.

Reviewed by: Logan Gunthorpe <logang@xxxxxxxxxxxx>

Logan