From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1CAE8C433F5 for ; Mon, 4 Oct 2021 13:02:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F405C61391 for ; Mon, 4 Oct 2021 13:02:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234317AbhJDNDu (ORCPT ); Mon, 4 Oct 2021 09:03:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:37450 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234102AbhJDNCH (ORCPT ); Mon, 4 Oct 2021 09:02:07 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9A8946136F; Mon, 4 Oct 2021 12:58:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1633352338; bh=TmY0Ggc7kznm0+HSGp0QLZ03YBiBeR1Q6935jrzMTBk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iZPmTwqPSeNY16K76iOmA4sUx2zP7rDoowcXL78qOV945u+66ekuEu0AhQI7ew+MV 9bThJ6v1rLmKuSdmXBchLK5HSm/LaxWIeCiDUq07lZ5Vb1b0kx5aTG0+lK2rjSmUoB wf/qUb816tnEYIlUBpY1KwSJ1fUMiGGx+cvuRWBA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com, Christoph Hellwig , NeilBrown , Song Liu , Sasha Levin Subject: [PATCH 4.14 22/75] md: fix a lock order reversal in md_alloc Date: Mon, 4 Oct 2021 14:51:57 +0200 Message-Id: <20211004125032.258530117@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20211004125031.530773667@linuxfoundation.org> References: <20211004125031.530773667@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Christoph Hellwig [ Upstream commit 7df835a32a8bedf7ce88efcfa7c9b245b52ff139 ] Commit b0140891a8cea3 ("md: Fix race when creating a new md device.") not only moved assigning mddev->gendisk before calling add_disk, which fixes the races described in the commit log, but also added a mddev->open_mutex critical section over add_disk and creation of the md kobj. Adding a kobject after add_disk is racy vs deleting the gendisk right after adding it, but md already prevents against that by holding a mddev->active reference. On the other hand taking this lock added a lock order reversal with what is not disk->open_mutex (used to be bdev->bd_mutex when the commit was added) for partition devices, which need that lock for the internal open for the partition scan, and a recent commit also takes it for non-partitioned devices, leading to further lockdep splatter. Fixes: b0140891a8ce ("md: Fix race when creating a new md device.") Fixes: d62633873590 ("block: support delayed holder registration") Reported-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig Tested-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com Reviewed-by: NeilBrown Signed-off-by: Song Liu Signed-off-by: Sasha Levin --- drivers/md/md.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 0af9aa187ce5..5e8706a66c31 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5375,10 +5375,6 @@ static int md_alloc(dev_t dev, char *name) */ disk->flags |= GENHD_FL_EXT_DEVT; mddev->gendisk = disk; - /* As soon as we call add_disk(), another thread could get - * through to md_open, so make sure it doesn't get too far - */ - mutex_lock(&mddev->open_mutex); add_disk(disk); error = kobject_init_and_add(&mddev->kobj, &md_ktype, @@ -5394,7 +5390,6 @@ static int md_alloc(dev_t dev, char *name) if (mddev->kobj.sd && sysfs_create_group(&mddev->kobj, &md_bitmap_group)) pr_debug("pointless warning\n"); - mutex_unlock(&mddev->open_mutex); abort: mutex_unlock(&disks_mutex); if (!error && mddev->kobj.sd) { -- 2.33.0