Re: [PATCH v3 15/17] scsi: sd: add mpath_dev file

[John Garry <john.g.garry@oracle.com>]

On 03/07/2026 13:43, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Concurrent sysfs read of `mpath_dev` can trigger a Use-After-Free of `sd_mpath_disk` during device removal.
> --
> 
> commit 96501c42f9a149bd257256a80ef8d931781b2efe
> Author: John Garry <john.g.garry@oracle.com>
> 
> scsi: sd: add mpath_dev file
> 
> This commit adds a mpath_dev sysfs file to allow looking up the multipath
> disk from the per-path gendisk directory.
> 
>> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
>> index a9a29e50f5eec..0c77466f8291a 100644
>> --- a/drivers/scsi/sd.c
>> +++ b/drivers/scsi/sd.c
> [ ... ]
>> @@ -4059,6 +4059,52 @@ static int sd_mpath_revalidate_head(struct scsi_disk *sdkp)
>>   
>>   	return ret;
>>   }
>> +
>> +static ssize_t sd_mpath_dev_show(struct device *dev,
>> +			struct device_attribute *attr, char *page)
>> +{
>> +	struct gendisk *gd = dev_to_disk(dev);
>> +	struct scsi_disk *sdkp = gd->private_data;
>> +	struct sd_mpath_disk *sd_mpath_disk = sdkp->sd_mpath_disk;
>> +	struct scsi_mpath_head *scsi_mpath_head = sd_mpath_disk->scsi_mpath_head;
> 
> [Severity: High]
> Can reading this sysfs attribute concurrently with device removal trigger a
> use-after-free of sdkp->sd_mpath_disk?

I think that we can avoid referencing sd_mpath_disk

> 
> During device teardown, sd_remove() calls sd_mpath_remove() before calling
> del_gendisk(). This frees the multipath structures, but the mpath_dev sysfs
> attribute (which is tied to the gendisk) remains active and accessible until
> del_gendisk() finally tears it down.
> 
> If a user continuously reads this attribute during hot-unplug or module
> removal, it appears we could blindly dereference the freed sd_mpath_disk
> pointer here.
> 
>> +	struct mpath_head *mpath_head = &scsi_mpath_head->mpath_head;
>> +	struct gendisk *disk = mpath_head->disk;
>> +	struct device *disk_dev = disk_to_dev(disk);
>> +
>> +	return print_dev_t(page, disk_dev->devt);
>> +}
>