Patch "xfs: set healthmon mount cookie before publishing it" has been added to the 7.3-stable tree

[Sasha Levin <sashal@kernel.org>]

This is a note to let you know that I've just added the patch titled

    xfs: set healthmon mount cookie before publishing it

to the 7.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     xfs-set-healthmon-mount-cookie-before-publishing-it.patch
and it can be found in the queue-7.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.



commit 8b5b37338aa9db56a72115e694a6b4339cdf15ba
Author: Binbin Deng <18983559317@163.com>
Date:   Thu Oct 15 16:02:25 2026 +0800

    xfs: set healthmon mount cookie before publishing it
    
    [ Upstream commit 0344a9492efac4c79202a07cf284a382f7054170 ]
    
    xfs_ioc_health_monitor() allocates the healthmon object with kzalloc(), so
    mount_cookie starts as zero.  zero is also DETACHED_MOUNT_COOKIE, but
    xfs_healthmon_attach() publishes hm through mp->m_healthmon before storing
    the mount cookie.  A concurrent reporter can therefore acquire hm from
    xfs_healthmon_get(), see the detached cookie in xfs_healthmon_push(), and
    drop the event even though the monitor is being attached.
    
    This is reachable by racing XFS_IOC_HEALTH_MONITOR with an operation
    that reports a health event, such as a filesystem shutdown.  Initialize
    the mount cookie before making hm visible through the RCU pointer so
    reporters always observe an attached monitor.
    
    Found during a static-analysis-assisted audit: candidate sites were
    surfaced by a Coccinelle rule, and the reader/writer paths were
    confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
    not observed at runtime; it is identified by code inspection only.
    
    Fixes: a48373e7d35a ("xfs: start creating infrastructure for health monitoring")
    Cc: stable@vger.kernel.org
    Signed-off-by: Binbin Deng <18983559317@163.com>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Darrick J. Wong <djwong@kernel.org>
    Signed-off-by: Carlos Maiolino <cem@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/xfs/xfs_healthmon.c b/fs/xfs/xfs_healthmon.c
index 2bdd747f1ead2..05d6f0494139d 100644
--- a/fs/xfs/xfs_healthmon.c
+++ b/fs/xfs/xfs_healthmon.c
@@ -114,8 +114,8 @@ xfs_healthmon_attach(
 	}
 
 	refcount_inc(&hm->ref);
-	rcu_assign_pointer(mp->m_healthmon, hm);
 	hm->mount_cookie = (uintptr_t)mp->m_super;
+	rcu_assign_pointer(mp->m_healthmon, hm);
 	spin_unlock(&xfs_healthmon_lock);
 
 	return 0;