Re: [PATCH v3 15/17] scsi: sd: add mpath_dev file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Concurrent sysfs read of `mpath_dev` can trigger a Use-After-Free of `sd_mpath_disk` during device removal.
--

commit 96501c42f9a149bd257256a80ef8d931781b2efe
Author: John Garry <john.g.garry@oracle.com>

scsi: sd: add mpath_dev file

This commit adds a mpath_dev sysfs file to allow looking up the multipath
disk from the per-path gendisk directory.

> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index a9a29e50f5eec..0c77466f8291a 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
[ ... ]
> @@ -4059,6 +4059,52 @@ static int sd_mpath_revalidate_head(struct scsi_disk *sdkp)
>  
>  	return ret;
>  }
> +
> +static ssize_t sd_mpath_dev_show(struct device *dev,
> +			struct device_attribute *attr, char *page)
> +{
> +	struct gendisk *gd = dev_to_disk(dev);
> +	struct scsi_disk *sdkp = gd->private_data;
> +	struct sd_mpath_disk *sd_mpath_disk = sdkp->sd_mpath_disk;
> +	struct scsi_mpath_head *scsi_mpath_head = sd_mpath_disk->scsi_mpath_head;

[Severity: High]
Can reading this sysfs attribute concurrently with device removal trigger a
use-after-free of sdkp->sd_mpath_disk?

During device teardown, sd_remove() calls sd_mpath_remove() before calling
del_gendisk(). This frees the multipath structures, but the mpath_dev sysfs
attribute (which is tied to the gendisk) remains active and accessible until
del_gendisk() finally tears it down.

If a user continuously reads this attribute during hot-unplug or module
removal, it appears we could blindly dereference the freed sd_mpath_disk
pointer here.

> +	struct mpath_head *mpath_head = &scsi_mpath_head->mpath_head;
> +	struct gendisk *disk = mpath_head->disk;
> +	struct device *disk_dev = disk_to_dev(disk);
> +
> +	return print_dev_t(page, disk_dev->devt);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703103402.3725011-1-john.g.garry@oracle.com?part=15