Re: [PATCH 1/3] virtiofs: fix use-after-free of fs->tag on device removal

[sashiko-bot@kernel.org]

> The virtio_fs object is refcounted via its kobject, so a mount can keep it
> alive well beyond the lifetime of the virtio device binding.  The tag
> string, however, was allocated with devm_kmalloc() and is therefore freed
> by devres_release_all() as soon as the device is unbound, i.e. right after
> virtio_fs_remove() returns (see device_unbind_cleanup() in
> drivers/base/dd.c).
> 
> virtio_fs_get_tree() looks up the instance, takes a kobject reference and
> then drops virtio_fs_mutex before doing the sleepable part of the mount
> (allocations, fuse_conn_init(), sget_fc()).  A concurrent device removal
> can complete in that window:
> 
>   CPU 0 (mount)                         CPU 1 (remove)
>   -------------                         --------------
>   virtio_fs_get_tree()
> [ ... ]
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: <stable@vger.kernel.org>
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/bug/linux-0328b3a1-043b-468e-8425-6a613d91b5ef
> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105150943.86650-1-mszeredi@redhat.com?part=1