Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2b5befcd authored by Christoph Hellwig's avatar Christoph Hellwig Committed by Greg Kroah-Hartman
Browse files

md: fix a lock order reversal in md_alloc 



[ Upstream commit 7df835a32a8bedf7ce88efcfa7c9b245b52ff139 ]

Commit b0140891 ("md: Fix race when creating a new md device.")
not only moved assigning mddev->gendisk before calling add_disk, which
fixes the races described in the commit log, but also added a
mddev->open_mutex critical section over add_disk and creation of the
md kobj.  Adding a kobject after add_disk is racy vs deleting the gendisk
right after adding it, but md already prevents against that by holding
a mddev->active reference.

On the other hand taking this lock added a lock order reversal with what
is not disk->open_mutex (used to be bdev->bd_mutex when the commit was
added) for partition devices, which need that lock for the internal open
for the partition scan, and a recent commit also takes it for
non-partitioned devices, leading to further lockdep splatter.

Fixes: b0140891 ("md: Fix race when creating a new md device.")
Fixes: d62633873590 ("block: support delayed holder registration")
Reported-by: default avatar <syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
Tested-by: default avatar <syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com>
Reviewed-by: default avatarNeilBrown <neilb@suse.de>
Signed-off-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 42d3711c

drivers/md/md.c

+0 −5
Original line number Diff line number Diff line
@@ -5535,10 +5535,6 @@ static int md_alloc(dev_t dev, char *name) 
	 */

	disk->flags |= GENHD_FL_EXT_DEVT;

	mddev->gendisk = disk;

	/* As soon as we call add_disk(), another thread could get

	 * through to md_open, so make sure it doesn't get too far

	 */

	mutex_lock(&mddev->open_mutex);

	add_disk(disk);



	error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
@@ -5553,7 +5549,6 @@ static int md_alloc(dev_t dev, char *name) 
	if (mddev->kobj.sd &&

	    sysfs_create_group(&mddev->kobj, &md_bitmap_group))

		pr_debug("pointless warning\n");

	mutex_unlock(&mddev->open_mutex);

 abort:

	mutex_unlock(&disks_mutex);

	if (!error && mddev->kobj.sd) {