Re: [BUG] possible race between md_free_disk and md_notify_reboot

[Yu Kuai <yukuai1@huaweicloud.com>]

Hi,

在 2025/02/21 23:19, Guillaume Morin 写道:
> 2) Instead of mddev_free() being called for mddev N+1 like in 1, I wonder
> what's preventing mddev_free() being called for mddev N (the one we're
> iterating about). Something like
> 
> CPU1							CPU2
> list_for_each_entry(mddev, &all_mddevs, all_mddevs) {
> if (!mddev_get(mddev))
>      continue;
> spin_unlock(&all_mddevs_lock);
> 						        mddev_free(mddev) (same mddev as CPU1)
> 
> mddev_free() does not check the active atomic, or acquire the
> reconfig_mutex/md_lock and will kfree() mddev. So the loop execution
> on CPU1 after spin_unlock() could be a UAF.
> 
> So I was wondering if you could clarify what is preventing race 2?
> i.e what is preventing mddev_free(mddev) from being calling kfree(mddev)
> while the md_notify_reboot() loop is handling mddev.

I said already, please take a look how mddev_put() works, mddev_free()
can't be called untill the reference is released after mddev_get().

Thanks,
Kuai