[PATCH] md: make mddev_get() fail until md_alloc() has finished

[Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>]

md_alloc() makes the disk visible with add_disk() before it adds
mddev->kobj. In between, md_open() can take a reference with
mddev_get() and send ioctls to an mddev whose kobject is not set up
yet, for example ADD_NEW_DISK, which adds the rdev kobject under
mddev->kobj.

If kobject_add() then fails, md_alloc() drops its own reference and
expects mddev_put() to delete the mddev. A reference taken in the
window keeps it alive instead, and if a command such as SET_ARRAY_INFO
sets ->ctime, the final __mddev_put() keeps the mddev for good.

Add mddev->sysfs_live, set under all_mddevs_lock after kobject_add()
succeeds and the sysfs handles are cached. Make mddev_get() fail
while it is not set. mddev_get() already runs under all_mddevs_lock,
so whoever gets a reference sees a fully set up mddev.

Also, send the KOBJ_ADD uevent only after mddev->sysfs_live is set,
so that user space reacting to it finds a usable mddev.

An open that races with md_alloc() now fails with -ENODEV, and a
sysfs read in md/ before the flag is set fails with -EBUSY.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20261029202209.1422567-1-abd.masalkhi@gmail.com?part=4
Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com>
---
 drivers/md/md.c | 10 ++++++++--
 drivers/md/md.h |  4 ++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/md/md.c b/drivers/md/md.c
index 154ee5a65cb7..20acd1e25e9e 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -627,7 +627,7 @@ static inline struct mddev *mddev_get(struct mddev *mddev)
 {
 	lockdep_assert_held(&all_mddevs_lock);
 
-	if (test_bit(MD_DELETED, &mddev->flags))
+	if (test_bit(MD_DELETED, &mddev->flags) || !mddev->sysfs_live)
 		return NULL;
 	atomic_inc(&mddev->active);
 	return mddev;
@@ -6403,10 +6403,16 @@ struct mddev *md_alloc(dev_t dev, char *name)
 		return ERR_PTR(error);
 	}
 
-	kobject_uevent(&mddev->kobj, KOBJ_ADD);
 	mddev->sysfs_state = sysfs_get_dirent_safe(mddev->kobj.sd, "array_state");
 	mddev->sysfs_level = sysfs_get_dirent_safe(mddev->kobj.sd, "level");
+
+	spin_lock(&all_mddevs_lock);
+	mddev->sysfs_live = true;
+	spin_unlock(&all_mddevs_lock);
+
+	kobject_uevent(&mddev->kobj, KOBJ_ADD);
 	mutex_unlock(&disks_mutex);
+
 	return mddev;
 
 out_put_disk:
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 6440da292105..5e026307ca64 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -417,6 +417,10 @@ struct mddev {
 	struct mutex			suspend_mutex;
 	struct percpu_ref		active_io;
 	int				ro;
+	bool				sysfs_live; /* set under all_mddevs_lock
+						     * after kobject_add()
+						     * succeeds, never cleared
+						     */
 	int				sysfs_active; /* set when sysfs deletes
 						       * are happening, so run/
 						       * takeover/stop are not safe
-- 
2.43.0