Patch "md: don't dereference mddev after export_rdev()" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    md: don't dereference mddev after export_rdev()

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     md-don-t-dereference-mddev-after-export_rdev.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9308ea378e77610f8a79dd345156bf4b01c0ada0
Author: Yu Kuai <yukuai3@xxxxxxxxxx>
Date:   Fri Aug 25 10:55:31 2023 +0800

    md: don't dereference mddev after export_rdev()
    
    [ Upstream commit 7deac114be5fb25a4e865212ed0feaf5f85f2a28 ]
    
    Except for initial reference, mddev->kobject is referenced by
    rdev->kobject, and if the last rdev is freed, there is no guarantee that
    mddev is still valid. Hence mddev should not be used anymore after
    export_rdev().
    
    This problem can be triggered by following test for mdadm at very
    low rate:
    
    New file: mdadm/tests/23rdev-lifetime
    
    devname=${dev0##*/}
    devt=`cat /sys/block/$devname/dev`
    pid=""
    runtime=2
    
    clean_up_test() {
            pill -9 $pid
            echo clear > /sys/block/md0/md/array_state
    }
    
    trap 'clean_up_test' EXIT
    
    add_by_sysfs() {
            while true; do
                    echo $devt > /sys/block/md0/md/new_dev
            done
    }
    
    remove_by_sysfs(){
            while true; do
                    echo remove > /sys/block/md0/md/dev-${devname}/state
            done
    }
    
    echo md0 > /sys/module/md_mod/parameters/new_array || die "create md0 failed"
    
    add_by_sysfs &
    pid="$pid $!"
    
    remove_by_sysfs &
    pid="$pid $!"
    
    sleep $runtime
    exit 0
    
    Test cmd:
    
    ./test --save-logs --logdir=/tmp/ --keep-going --dev=loop --tests=23rdev-lifetime
    
    Test result:
    
    general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bcb: 0000 [#4] PREEMPT SMP
    CPU: 0 PID: 1292 Comm: test Tainted: G      D W          6.5.0-rc2-00121-g01e55c376936 #562
    RIP: 0010:md_wakeup_thread+0x9e/0x320 [md_mod]
    Call Trace:
     <TASK>
     mddev_unlock+0x1b6/0x310 [md_mod]
     rdev_attr_store+0xec/0x190 [md_mod]
     sysfs_kf_write+0x52/0x70
     kernfs_fop_write_iter+0x19a/0x2a0
     vfs_write+0x3b5/0x770
     ksys_write+0x74/0x150
     __x64_sys_write+0x22/0x30
     do_syscall_64+0x40/0x90
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    
    Fix this problem by don't dereference mddev after export_rdev().
    
    Fixes: 3ce94ce5d05a ("md: fix duplicate filename for rdev")
    Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx>
    Signed-off-by: Song Liu <song@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230825025532.1523008-2-yukuai1@xxxxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 2a4a3d3039fae..fba2809cd384a 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -798,14 +798,14 @@ void mddev_unlock(struct mddev *mddev)
 	} else
 		mutex_unlock(&mddev->reconfig_mutex);
 
+	md_wakeup_thread(mddev->thread);
+	wake_up(&mddev->sb_wait);
+
 	list_for_each_entry_safe(rdev, tmp, &delete, same_set) {
 		list_del_init(&rdev->same_set);
 		kobject_del(&rdev->kobj);
 		export_rdev(rdev, mddev);
 	}
-
-	md_wakeup_thread(mddev->thread);
-	wake_up(&mddev->sb_wait);
 }
 EXPORT_SYMBOL_GPL(mddev_unlock);