md_alloc() publishes the gendisk with add_disk() before it initializes
and registers mddev->kobj. A concurrent open can issue ADD_NEW_DISK in
this window, causing bind_rdev_to_array() to pass the uninitialized
mddev kobject as a parent to kobject_add(). This triggers a kobject
warning.

Set MD_CLOSING before publishing the disk so md_open() rejects opens
until the kobject and sysfs attributes are ready. Clear the bit under
open_mutex, which md_open() holds while checking it.

Compile-tested with ARCH=arm64 defconfig and drivers/md/md.o. The
upstream syzbot report has no reproducer, so this race was not tested
at runtime.

Fixes: 7df835a32a8b ("md: fix a lock order reversal in md_alloc")
Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=95eeb4ada2349a2170ea
Assisted-by: LLM
Signed-off-by: By <xiaobai050@gmail.com>
---
 drivers/md/md.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63..11b0b6b13 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6385,6 +6385,8 @@ struct mddev *md_alloc(dev_t dev, char *name)
 
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
+	/* add_disk() exposes the device before its md kobject is registered. */
+	set_bit(MD_CLOSING, &mddev->flags);
 	error = add_disk(disk);
 	if (error)
 		goto out_put_disk;
@@ -6406,6 +6408,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
 	kobject_uevent(&mddev->kobj, KOBJ_ADD);
 	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
 	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
+	mutex_lock(&mddev->open_mutex);
+	clear_bit(MD_CLOSING, &mddev->flags);
+	mutex_unlock(&mddev->open_mutex);
 	mutex_unlock(&disks_mutex);
 	return mddev;
 
-- 
2.55.0

Hi,

在 2026/9/23 15:10, By 写道:
> md_alloc() publishes the gendisk with add_disk() before it initializes
> and registers mddev->kobj. A concurrent open can issue ADD_NEW_DISK in
> this window, causing bind_rdev_to_array() to pass the uninitialized
> mddev kobject as a parent to kobject_add(). This triggers a kobject
> warning.
>
> Set MD_CLOSING before publishing the disk so md_open() rejects opens
> until the kobject and sysfs attributes are ready. Clear the bit under
> open_mutex, which md_open() holds while checking it.
>
> Compile-tested with ARCH=arm64 defconfig and drivers/md/md.o. The
> upstream syzbot report has no reproducer, so this race was not tested
> at runtime.
>
> Fixes: 7df835a32a8b ("md: fix a lock order reversal in md_alloc")
> Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=95eeb4ada2349a2170ea
> Assisted-by: LLM
> Signed-off-by: By <xiaobai050@gmail.com>
> ---
>   drivers/md/md.c | 5 +++++
>   1 file changed, 5 insertions(+)
>
> diff --git a/drivers/md/md.c b/drivers/md/md.c
> index 680b34a63..11b0b6b13 100644
> --- a/drivers/md/md.c
> +++ b/drivers/md/md.c
> @@ -6385,6 +6385,8 @@ struct mddev *md_alloc(dev_t dev, char *name)
>   
>   	disk->events |= DISK_EVENT_MEDIA_CHANGE;
>   	mddev->gendisk = disk;
> +	/* add_disk() exposes the device before its md kobject is registered. */
> +	set_bit(MD_CLOSING, &mddev->flags);
>   	error = add_disk(disk);
>   	if (error)
>   		goto out_put_disk;
> @@ -6406,6 +6408,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
>   	kobject_uevent(&mddev->kobj, KOBJ_ADD);
>   	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
>   	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
> +	mutex_lock(&mddev->open_mutex);
> +	clear_bit(MD_CLOSING, &mddev->flags);
> +	mutex_unlock(&mddev->open_mutex);

I don't like this fix, it introduces a race window that open md device will fail. Instead,
since all bind_rdev_to_array() is already protected by reconfig_mutex, can this problem be
fixed by holding reconfig_mutex for both add_disk and kobject_add?

>   	mutex_unlock(&disks_mutex);
>   	return mddev;
>   

-- 
Thanks,
Kuai