From 900bf42e0ff8009f66ffd4a679c56264957019dd Mon Sep 17 00:00:00 2001 From: Nguyen Ngoc Thang Date: Fri, 25 Sep 2026 00:13:45 +0700 Subject: [PATCH] md: take reconfig_mutex when enabling PPL on an inactive array consistency_policy_store() sets MD_HAS_PPL for an external-metadata array that is not running yet, without holding reconfig_mutex. But ->pers is only assigned after pers->run() returns, so "not running" also covers an md_run() that is in progress under the lock. If the write lands inside raid5_run() after log_init() has decided not to set up PPL, or after a failed ppl_init_log() has cleared the flag, the flag ends up set with conf->log_private still NULL. The next idle pass of raid5d() then does: raid5d() -> handle_active_stripes() -> log_flush_stripe_to_raid() -> ppl_write_stripe_run() and dereferences the NULL ppl_conf: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ppl_write_stripe_run+0x60/0x1320 drivers/md/raid5-ppl.c:538 Take reconfig_mutex around the update and refuse it with -EBUSY once the array is running, in which case ->change_consistency_policy() is the right interface. Fixes: 664aed04446c ("md: add sysfs entries for PPL") Reported-by: syzbot+75d7e96ad03ac2dbbd9f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=75d7e96ad03ac2dbbd9f Signed-off-by: Nguyen Ngoc Thang Link: https://patch.msgid.link/20260924171345.75894-1-ngocthang2710.1999@gmail.com Signed-off-by: Yu Kuai --- drivers/md/md.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 3cb961036637..0f7115b31ca3 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -5884,7 +5884,15 @@ consistency_policy_store(struct mddev *mddev, const char *buf, size_t len) else err = -EBUSY; } else if (mddev->external && strncmp(buf, "ppl", 3) == 0) { - set_bit(MD_HAS_PPL, &mddev->flags); + /* md_run() holds the lock until ->pers is set */ + err = mddev_lock(mddev); + if (err) + return err; + if (mddev->pers) + err = -EBUSY; + else + set_bit(MD_HAS_PPL, &mddev->flags); + mddev_unlock(mddev); } else { err = -EINVAL; }