Re: [PATCH] md: fix use-after-free in md_attr_store()

["yu kuai" <yukuai@fygo.io>]

在 2026/11/2 20:23, Sajal Gupta 写道:

> md_attr_store() calls sysfs_break_active_protection() for a "clear"
> write to array_state before it calls mddev_get().
> sysfs_break_active_protection() does kobject_get() on the mddev
> kobject. If the array is concurrently being deleted, the kobject
> refcount can already be zero, which triggers "refcount_t: addition on 0;
> use-after-free".
>
> Fix by calling mddev_get() first. If the array is being deleted it
> fails with -EBUSY before the kobject is touched, and if it succeeds the
> array cannot be freed until mddev_put(). The -EBUSY path no longer
> needs to call sysfs_unbreak_active_protection().
>
> Fixes: 9e59d609763f ("md: call del_gendisk in control path")
> Reported-by:syzbot+dcad997ed2b5bd95cc5e@syzkaller.appspotmail.com
> Closes:https://syzkaller.appspot.com/bug?extid=dcad997ed2b5bd95cc5e
> Tested-by:syzbot+dcad997ed2b5bd95cc5e@syzkaller.appspotmail.com
> Signed-off-by: Sajal Gupta<sajal2005gupta@gmail.com>
> ---
>   drivers/md/md.c | 9 ++++-----
>   1 file changed, 4 insertions(+), 5 deletions(-)
Applied

-- 
Thanks,
Kuai