[PATCH] md: prevent opening an array before its sysfs kobject is ready

[By <xiaobai050@gmail.com>]

md_alloc() publishes the gendisk with add_disk() before it initializes
and registers mddev->kobj. A concurrent open can issue ADD_NEW_DISK in
this window, causing bind_rdev_to_array() to pass the uninitialized
mddev kobject as a parent to kobject_add(). This triggers a kobject
warning.

Set MD_CLOSING before publishing the disk so md_open() rejects opens
until the kobject and sysfs attributes are ready. Clear the bit under
open_mutex, which md_open() holds while checking it.

Compile-tested with ARCH=arm64 defconfig and drivers/md/md.o. The
upstream syzbot report has no reproducer, so this race was not tested
at runtime.

Fixes: 7df835a32a8b ("md: fix a lock order reversal in md_alloc")
Reported-by: syzbot+95eeb4ada2349a2170ea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=95eeb4ada2349a2170ea
Assisted-by: LLM
Signed-off-by: By <xiaobai050@gmail.com>
---
 drivers/md/md.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 680b34a63..11b0b6b13 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -6385,6 +6385,8 @@ struct mddev *md_alloc(dev_t dev, char *name)
 
 	disk->events |= DISK_EVENT_MEDIA_CHANGE;
 	mddev->gendisk = disk;
+	/* add_disk() exposes the device before its md kobject is registered. */
+	set_bit(MD_CLOSING, &mddev->flags);
 	error = add_disk(disk);
 	if (error)
 		goto out_put_disk;
@@ -6406,6 +6408,9 @@ struct mddev *md_alloc(dev_t dev, char *name)
 	kobject_uevent(&mddev->kobj, KOBJ_ADD);
 	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
 	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
+	mutex_lock(&mddev->open_mutex);
+	clear_bit(MD_CLOSING, &mddev->flags);
+	mutex_unlock(&mddev->open_mutex);
 	mutex_unlock(&disks_mutex);
 	return mddev;
 
-- 
2.55.0