[PATCH] md: avoid block autoload while importing rdev under reconfig_mutex

[Wang Jichen]

From: wangjichen <wangjichen@xxxxxxxxxxx>

md_import_device() runs with mddev->reconfig_mutex held from md_ioctl().
Opening a member disk via bdev_file_open_by_dev() triggers legacy block
autoload (blk_probe_dev), which takes major_names_lock. md_probe() can
run under that lock and call md_alloc(), which takes disks_mutex and
reconfig_mutex — a lockdep ABBA with the ioctl path.

Add bdev_file_open_by_dev_autoload() and use autoload=false from
md_import_device(); member devices must already be present in the
block layer (normal mdadmin usage).

Link: https://syzbot.org/bug?extid=cd254889291ef8666036
Reported-by: syzbot+cd254889291ef8666036@xxxxxxxxxxxxxxxxxxxxxxxxx
Tested-by: Wang Jichen <wangjichen@xxxxxxxxxxx>
Signed-off-by: Wang Jichen <wangjichen@xxxxxxxxxxx>
---
 block/bdev.c           | 13 ++++++++++---
 drivers/md/md.c        |  8 ++++++--
 include/linux/blkdev.h |  2 ++
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/block/bdev.c b/block/bdev.c
index f20f91b31..e78936556 100644
--- a/block/bdev.c
+++ b/block/bdev.c
@@ -1076,8 +1076,8 @@ static unsigned blk_to_file_flags(blk_mode_t mode)
 	return flags;
 }
 
-struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
-				   const struct blk_holder_ops *hops)
+struct file *bdev_file_open_by_dev_autoload(dev_t dev, blk_mode_t mode,
+		void *holder, const struct blk_holder_ops *hops, bool autoload)
 {
 	struct file *bdev_file;
 	struct block_device *bdev;
@@ -1088,7 +1088,7 @@ struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
 	if (ret)
 		return ERR_PTR(ret);
 
-	bdev = blkdev_get_no_open(dev, true);
+	bdev = blkdev_get_no_open(dev, autoload);
 	if (!bdev)
 		return ERR_PTR(-ENXIO);
 
@@ -1110,6 +1110,13 @@ struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
 	}
 	return bdev_file;
 }
+EXPORT_SYMBOL(bdev_file_open_by_dev_autoload);
+
+struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
+				   const struct blk_holder_ops *hops)
+{
+	return bdev_file_open_by_dev_autoload(dev, mode, holder, hops, true);
+}
 EXPORT_SYMBOL(bdev_file_open_by_dev);
 
 struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode,
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 03e35386a..d3717e2e8 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3858,9 +3858,13 @@ static struct md_rdev *md_import_device(dev_t newdev, int super_format, int supe
 	if (err)
 		goto out_clear_rdev;
 
-	rdev->bdev_file = bdev_file_open_by_dev(newdev,
+	/*
+	 * md_ioctl() holds reconfig_mutex; legacy autoload in bdev open takes
+	 * major_names_lock via blk_probe_dev() and can deadlock with md_probe().
+	 */
+	rdev->bdev_file = bdev_file_open_by_dev_autoload(newdev,
 			BLK_OPEN_READ | BLK_OPEN_WRITE,
-			super_format == -2 ? &claim_rdev : rdev, NULL);
+			super_format == -2 ? &claim_rdev : rdev, NULL, false);
 	if (IS_ERR(rdev->bdev_file)) {
 		pr_warn("md: could not open device unknown-block(%u,%u).\n",
 			MAJOR(newdev), MINOR(newdev));
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 0c2010230..e5121101a 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1699,6 +1699,8 @@ struct blk_holder_ops {
 
 struct file *bdev_file_open_by_dev(dev_t dev, blk_mode_t mode, void *holder,
 		const struct blk_holder_ops *hops);
+struct file *bdev_file_open_by_dev_autoload(dev_t dev, blk_mode_t mode,
+		void *holder, const struct blk_holder_ops *hops, bool autoload);
 struct file *bdev_file_open_by_path(const char *path, blk_mode_t mode,
 		void *holder, const struct blk_holder_ops *hops);
 int bd_prepare_to_claim(struct block_device *bdev, void *holder,
-- 
2.34.1