Root Cause Analysis

1. Functions, Structs, and Files Involved

• drivers/md/md.c:
  • md_attr_store(): sysfs write callback for mddev attributes.
  • mddev_delayed_delete() / __mddev_put() / mddev_put(): cleanup path that invokes kobject_put(&mddev->kobj) when mddev->active drops to zero.
  • struct mddev: contains embedded struct kobject kobj and flags like MD_DELETED.
• fs/sysfs/file.c:
  • sysfs_break_active_protection(): breaks active kernfs protection; unconditionally calls kobject_get(kobj).
• lib/kobject.c:
  • kobject_get() -> kref_get() -> refcount_inc(): attempts to increment kobj->kref.refcount.
  • kobject_put() -> kref_put() -> kobject_release() / kobject_cleanup(): drops the last refcount and tears down sysfs files via __kobject_del().

2. Triggering Mechanism and Lifecycle Invariant Violation

In sysfs/kernfs, file operations (e.g. kernfs_fop_write_iter() -> sysfs_kf_write()) acquire an active reference on the kernfs_node (kernfs_get_active_of()), but they do not take a reference on the associated struct kobject (mddev->kobj). Instead, kernfs relies on kobject_del() / sysfs_remove_dir() invoking kernfs_drain() during teardown to wait for all in-flight file operations to finish before releasing resources.

In drivers/md/md.c:

1. When an mddev is torn down or stopped, mddev_put() drops mddev->active to 0. __mddev_put() queues mddev->del_work (mddev_delayed_delete), which calls kobject_put(&mddev->kobj).
2. kobject_put() invokes kref_put(&kobj->kref, kobject_release), which decrements kobj->kref.refcount from 1 to 0 before entering kobject_cleanup().
3. In kobject_cleanup(), __kobject_del() is called to remove the sysfs directory and drain active kernfs references.
4. However, if a user write of "clear" to /sys/block/mdX/md/array_state executes concurrently, it can successfully acquire the kernfs active reference (kernfs_get_active_of()) right before __kobject_del() drains the node.
5. In md_attr_store() (drivers/md/md.c:6166-6176):

   if (entry->store == array_state_store && cmd_match(page, "clear"))
       kn = sysfs_break_active_protection(kobj, attr);
   
   spin_lock(&all_mddevs_lock);
   if (!mddev_get(mddev)) {
       ...
   

   sysfs_break_active_protection(kobj, attr) is invoked before taking all_mddevs_lock and checking mddev_get(mddev) (which checks MD_DELETED and returns NULL).
6. sysfs_break_active_protection() calls kobject_get(kobj), which executes refcount_inc(&kobj->kref.refcount). Because the refcount is already 0, this violates the refcount invariant that an increment cannot occur on an object with refcount 0, triggering: refcount_t: addition on 0; use-after-free. -> kernel BUG at lib/refcount.c:34!

3. Runtime Consequences in Production Kernels

• MemoryCorruption (true): An addition on a refcount of 0 signifies that kobject_cleanup() is running or about to run concurrently. In kobject_cleanup(), md_kobj_release() -> put_disk() -> md_free_disk() frees struct mddev via kfree(mddev). Concurrently incrementing the refcount on a dying object and continuing to access mddev or subsequently calling kobject_put() / sysfs_unbreak_active_protection() leads to use-after-free, double-free, and refcount corruption.
• RawDenialOfService (true): On systems built with CONFIG_BUG_ON_DATA_CORRUPTION=y, the kernel hits an unrecoverable BUG() in refcount_warn_saturate(). On systems without it, use-after-free on struct mddev / kobj leads to kernel crash / panic or memory corruption when accessing the freed device.
• InfoLeak ("none"): The defect does not read or expose uninitialized or out-of-bounds kernel memory contents to userspace.
• IsNetCandidate (false): The defect is in the block MD RAID subsystem and sysfs file operations, unrelated to networking or network protocols.
• IsKVMCandidate (false): The defect is unrelated to virtualization, KVM, hypervisors, or virtio.