md: fix a lock order reversal in md_alloc

Commit 14efd1de693008 ("md: Fix race when creating a new md device.")
not only moved assigning mddev->gendisk before calling add_disk, which
fixes the races described in the commit log, but also added a
mddev->open_mutex critical section over add_disk and creation of the
md kobj.  Adding a kobject after add_disk is racy vs deleting the gendisk
right after adding it, but md already prevents against that by holding
a mddev->active reference.

On the other hand taking this lock added a lock order reversal with what
is not disk->open_mutex (used to be bdev->bd_mutex when the commit was
added) for partition devices, which need that lock for the internal open
for the partition scan, and a recent commit also takes it for
non-partitioned devices, leading to further lockdep splatter.

Fixes: 14efd1de6930 ("md: Fix race when creating a new md device.")
Fixes: b0775f6467e8 ("block: support delayed holder registration")
Reported-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Signed-off-by: Christoph Hellwig <hch@lst.de>
Tested-by: syzbot+fadc0aaf497e6a493b9f@syzkaller.appspotmail.com
Reviewed-by: NeilBrown <neilb@suse.de>
Signed-off-by: Song Liu <songliubraving@fb.com>

diff --git a/drivers/md/md.c b/drivers/md/md.c
index ae8fe54ea358194382d5951cd14d83338145dd43..6c0c3d0d905aaf79e6a9e9842a96da59a3e2819c 100644 (file)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5700,10 +5700,6 @@ static int md_alloc(dev_t dev, char *name)
        disk->flags |= GENHD_FL_EXT_DEVT;
        disk->events |= DISK_EVENT_MEDIA_CHANGE;
        mddev->gendisk = disk;
-       /* As soon as we call add_disk(), another thread could get
-        * through to md_open, so make sure it doesn't get too far
-        */
-       mutex_lock(&mddev->open_mutex);
        add_disk(disk);
 
        error = kobject_add(&mddev->kobj, &disk_to_dev(disk)->kobj, "%s", "md");
@@ -5718,7 +5714,6 @@ static int md_alloc(dev_t dev, char *name)
        if (mddev->kobj.sd &&
            sysfs_create_group(&mddev->kobj, &md_bitmap_group))
                pr_debug("pointless warning\n");
-       mutex_unlock(&mddev->open_mutex);
  abort:
        mutex_unlock(&disks_mutex);
        if (!error && mddev->kobj.sd) {