Re: [PATCH v4 26/28] scsi: sd: add mpath_dev file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Reading the `mpath_dev` sysfs attribute can cause a use-after-free of the multipath `gendisk` and `scsi_mpath_head` objects during SCSI path removal.
--

--- Patch [26]: [PATCH v4 26/28] scsi: sd: add mpath_dev file ---
commit 4a0e7acbc6d2b78e6b014dfe6924983c812cc80e
Author: John Garry <john.g.garry@oracle.com>
scsi: sd: add mpath_dev file

This commit adds a mpath_dev file so the multipath disk can be looked up
from the per-path gendisk directory. This allows utilities like lsscsi to
find the multipath disk even when the gendisk for the per-path scsi_device
is missing.

> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index d5a37b1b312c3..f8c9096e6c43c 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
[ ... ]
> @@ -4059,6 +4059,53 @@ static int sd_mpath_revalidate_head(struct scsi_disk *sdkp)
>  
>  	return ret;
>  }
> +
> +static ssize_t sd_mpath_dev_show(struct device *dev,
> +			struct device_attribute *attr, char *page)
> +{
> +	struct gendisk *gd = dev_to_disk(dev);
> +	struct scsi_disk *sdkp = gd->private_data;
> +	struct scsi_device *sdev = sdkp->device;
> +	struct scsi_mpath_device *scsi_mpath_dev = sdev->scsi_mpath_dev;
> +	struct scsi_mpath_head *scsi_mpath_head = scsi_mpath_dev->scsi_mpath_head;
> +	struct mpath_head *mpath_head = &scsi_mpath_head->mpath_head;
> +	struct gendisk *disk = mpath_head->disk;

[Severity: High]
Can a concurrent read of this sysfs file cause a use-after-free during device
removal?

Looking at sd_remove() in drivers/scsi/sd.c, it tears down the multipath
structures before removing the sysfs interfaces:

sd_remove() {
    if (sdp->scsi_mpath_dev)
        sd_mpath_remove(sdkp);
    ...
    device_del(&sdkp->disk_dev);
    del_gendisk(sdkp->disk);
}

Since del_gendisk() happens after sd_mpath_remove(), there is a window where
the mpath_dev sysfs file is still accessible but the underlying multipath
structures have been freed.

Could an unprivileged user read the mpath_dev file during this window and
dereference freed memory for scsi_mpath_head and mpath_head->disk?

> +	struct device *disk_dev = disk_to_dev(disk);
> +
> +	return print_dev_t(page, disk_dev->devt);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723093627.2327456-1-john.g.garry@oracle.com?part=26