Root Cause Analysis

Involved Components

• Source File: drivers/md/md.c
• Functions: md_start_sync(), remove_and_add_spares(), remove_spares(), stop_sync_thread(), do_md_stop(), md_check_recovery()
• Structures and Fields:
  • struct mddev: sync_work, pers, ro, recovery
  • struct md_personality: hot_remove_disk (at byte offset 0x50 / bit offset 640), hot_add_disk, sync_request

Technical Mechanism and Lifecycle Violation

1. Scheduling sync_work in Read-Only State: In the MD (Multiple Devices / RAID) subsystem, resynchronization or spare management is handled asynchronously by queuing mddev->sync_work onto md_misc_wq (running md_start_sync()). In md_check_recovery(), when an array is read-only (!md_is_rdwr(mddev), such as mddev->ro == MD_RDONLY), if spare disk reconfiguration is needed (md_spares_need_change(mddev)), it sets MD_RECOVERY_RUNNING and queues mddev->sync_work:

   if (md_spares_need_change(mddev)) {
       set_bit(MD_RECOVERY_RUNNING, &mddev->recovery);
       queue_work(md_misc_wq, &mddev->sync_work);
   }
   

   Unlike the read-write path in md_check_recovery() (which checks !test_bit(MD_RECOVERY_FROZEN, &mddev->recovery)), the read-only branch does not check MD_RECOVERY_FROZEN before queuing sync_work.

2. Array Teardown / Personality Detach: When an array is stopped or set inactive (e.g., via do_md_stop() through sysfs or ioctl), the array stop sequence invokes stop_sync_thread() and then __md_stop().

   • In stop_sync_thread(), if sync_work has already begun execution (process_one_work() in the worker thread clears WORK_STRUCT_PENDING_BIT), work_pending(&mddev->sync_work) evaluates to false, bypassing flush_work(&mddev->sync_work). Furthermore, if MD_RECOVERY_RUNNING was not set, stop_sync_thread() returns early without flushing.
   • do_md_stop() then calls __md_stop(), which detaches the personality and sets:

     spin_lock(&mddev->lock);
     mddev->pers = NULL;
     spin_unlock(&mddev->lock);
     

   • While do_md_stop() holds reconfig_mutex (mddev_lock), md_start_sync() may be queued or waiting for reconfig_mutex (after calling mddev_suspend()).

3. Missing pers Validation in md_start_sync(): Once do_md_stop() finishes and releases reconfig_mutex, md_start_sync() acquires mddev_lock_nointr(mddev). It assumes mddev->pers is always valid and does not check if (!mddev->pers) before dispatching operations. Because !md_is_rdwr(mddev) is true, it enters:

   if (!md_is_rdwr(mddev)) {
       remove_and_add_spares(mddev, NULL);
       goto not_running;
   }
   

4. The Crash Site: remove_and_add_spares() invokes remove_spares(mddev, NULL). When evaluating removable disks:

   rdev_for_each(rdev, mddev) {
       if ((this == NULL || rdev == this) && rdev_removeable(rdev) &&
           !mddev->pers->hot_remove_disk(mddev, rdev)) {
   

   remove_spares() dereferences mddev->pers->hot_remove_disk. Because mddev->pers is NULL, computing the function pointer address adds offset 0x50 (offsetof(struct md_personality, hot_remove_disk)) to NULL. KASAN intercepts the access at shadow address dfff800000000000 + (0x50 >> 3) = dfff80000000000a, triggering a kernel translation fault / NULL pointer dereference oops.