[PATCH v3] md: fix sync_work vs array teardown races

[Li Youhong]

From: Li Youhong <liyouhong@xxxxxxxxxx>

dm-raid tears down arrays via md_stop(), which cleared mddev->pers
without waiting for previously queued sync_work. That work could
then call remove_spares() with pers == NULL, or keep using mddev
after raid_dtr() frees it.

do_md_stop()/md_stop_writes() already call stop_sync_thread() before
teardown. Do the same in md_stop().

Also fix two related completion/freeze holes that made that wait
unreliable:

- stop_sync_thread() waits for !MD_RECOVERY_RUNNING before teardown,
  but md_start_sync() could still use mddev after unlocking. Clear
  RUNNING only after those uses are done, then wake_up(&resync_wait).

- The read-only path in md_check_recovery() queued sync_work without
  honouring MD_RECOVERY_FROZEN, unlike the read-write path. Check
  FROZEN so freeze/stop cannot race with a new queue while
  stop_sync_thread() drops reconfig_mutex.

Fixes: db5e653d7c9f ("md: delay choosing sync action to md_start_sync()")
Fixes: 81e2ce1b3d5a ("md: delay remove_and_add_spares() for read only array to md_start_sync()")
Reported-by: syzbot+a53c2918175b36cfd601@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=a53c2918175b36cfd601
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Li Youhong <liyouhong@xxxxxxxxxx>
---
v3:
- Clear MD_RECOVERY_RUNNING only after md_start_sync() finishes using
  mddev on the not_running path.
- Honour MD_RECOVERY_FROZEN before queueing sync_work on the
  read-only md_check_recovery() path.
- v2: link: https://lore.kernel.org/linux-raid/20261109023055.2164333-1-dayou5941@xxxxxxx/

v2:
- Drop the pers NULL check in md_start_sync().
- Call stop_sync_thread() from md_stop() before clearing pers,
  matching do_md_stop()/md_stop_writes().
- v1: link: https://lore.kernel.org/linux-raid/20261106083543.249267-1-dayou5941@xxxxxxx

 drivers/md/md.c | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63cb3..18d37413ffaf 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7104,6 +7104,13 @@ void md_stop(struct mddev *mddev)
 	/* stop the array and free an attached data structures.
 	 * This is called from dm-raid
 	 */
+	/*
+	 * md_check_recovery() may have queued sync_work; that work accesses
+	 * pers. Wait for it here before __md_stop() clears pers, as
+	 * do_md_stop()/md_stop_writes() do.
+	 */
+	set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+	stop_sync_thread(mddev, true);
 	__md_stop_writes(mddev);
 	__md_stop(mddev);
 }
@@ -10343,7 +10350,6 @@ static void md_start_sync(struct work_struct *ws)
 	clear_bit(MD_RECOVERY_RESHAPE, &mddev->recovery);
 	clear_bit(MD_RECOVERY_REQUESTED, &mddev->recovery);
 	clear_bit(MD_RECOVERY_CHECK, &mddev->recovery);
-	clear_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
 	mddev_unlock(mddev);
 	/*
 	 * md_start_sync was triggered by MD_RECOVERY_NEEDED, so we should
@@ -10355,11 +10361,16 @@ static void md_start_sync(struct work_struct *ws)
 		memalloc_noio_restore(noio_flags);
 		__mddev_resume(mddev, false);
 	}
-
-	wake_up(&resync_wait);
 	if (test_and_clear_bit(MD_RECOVERY_RECOVER, &mddev->recovery) &&
 	    mddev->sysfs_action)
 		sysfs_notify_dirent_safe(mddev->sysfs_action);
+	/*
+	 * stop_sync_thread() waits for !RUNNING and may then tear down
+	 * the array. This path still uses mddev after unlocking, so
+	 * clear RUNNING only after those uses are done.
+	 */
+	clear_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
+	wake_up(&resync_wait);
 }
 
 static void unregister_sync_thread(struct mddev *mddev)
@@ -10494,9 +10505,11 @@ void md_check_recovery(struct mddev *mddev)
 
 			/*
 			 * Let md_start_sync() to remove and add rdevs to the
-			 * array.
+			 * array. Honour MD_RECOVERY_FROZEN like the read-write
+			 * path so freeze/stop does not race with a new queue.
 			 */
-			if (md_spares_need_change(mddev)) {
+			if (md_spares_need_change(mddev) &&
+			    !test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)) {
 				set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
 				queue_work(md_misc_wq, &mddev->sync_work);
 			}
-- 
2.25.1