Re: [PATCH v3 01/13] libmultipath: Add initial framework

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] A race condition between mpath_put_head() and mpath_head_uninit() leads to a use-after-free vulnerability when accessing mpath_head for cleanup.
--

commit 594f063adb51503b6e7af6741526b8d738fee5ba
Author: John Garry <john.g.garry@oracle.com>

libmultipath: Add initial framework

This commit adds the initial framework for libmultipath to support path
management, path selection, and failover handling for multipath-capable
block drivers. It introduces the mpath_head structure to manage available
paths and the multipath gendisk.

> diff --git a/lib/multipath.c b/lib/multipath.c
> new file mode 100644
> index 0000000000000..009d4bb875c6f
> --- /dev/null
> +++ b/lib/multipath.c

[ ... ]

> +void mpath_put_head(struct mpath_head *mpath_head)
> +{
> +	refcount_t *refcount = &mpath_head->refcount;
> +
> +	if (refcount_dec_and_test(refcount)) {

[Severity: High]
Could this introduce a use-after-free regression on the mpath_head structure?

If a teardown thread calls mpath_head_uninit() concurrently, it blocks in
wait_var_event() waiting for the refcount to drop to 0.

Once refcount_dec_and_test() drops the refcount to 0 here, the condition
!refcount_read(refcount) in mpath_head_uninit() can evaluate to true
immediately. The uninit thread could then wake up, return, and free mpath_head
before this thread completes mpath_head_cleanup() and wake_up_var().

> +		mpath_head_cleanup(mpath_head);
> +		wake_up_var(refcount);
> +	}
> +}
> +EXPORT_SYMBOL_GPL(mpath_put_head);
> +
> +void mpath_head_uninit(struct mpath_head *mpath_head)
> +{
> +	refcount_t *refcount = &mpath_head->refcount;
> +
> +	if (refcount_dec_and_test(refcount)) {
> +		mpath_head_cleanup(mpath_head);
> +	} else {
> +		wait_var_event(refcount, !refcount_read(refcount));
> +	}
> +}
> +EXPORT_SYMBOL_GPL(mpath_head_uninit);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703102918.3723667-1-john.g.garry@oracle.com?part=1