* [PATCH] xfs: serialize zoned sysfs reads against unmount
@ 2026-07-02 15:01 Cen Zhang
2026-07-02 15:34 ` Darrick J. Wong
0 siblings, 1 reply; 3+ messages in thread
From: Cen Zhang @ 2026-07-02 15:01 UTC (permalink / raw)
To: Carlos Maiolino, Hans Holmberg, Damien Le Moal
Cc: linux-xfs, linux-kernel, baijiaju1990, zzzccc427
The zoned sysfs kobject is removed late in xfs_unmountfs(), after
xfs_unmount_zones() has torn down the zone allocator. A read of
nr_open_zones can therefore enter through the still-live sysfs kobject
and dereference mp->m_zone_info after xfs_free_zone_info() has freed it.
Serialize the nr_open_zones show method against unmount with s_umount.
If unmount already owns the write side, fail the sysfs read before
touching m_zone_info. If the sysfs read gets in first, the unmount path
must wait until the read has copied zi_nr_open_zones. Also return
-ENODEV if the zoned sysfs node is visible before zone information is
available.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in nr_open_zones_show+0x86/0x90
The buggy address belongs to the object at ffff88810b177800 which belongs
to the cache kmalloc-1k of size 1024
The buggy address is located 160 bytes inside of freed 1024-byte region
[ffff88810b177800, ffff88810b177c00)
Read of size 4
Call trace:
print_report+0xcd/0x620
nr_open_zones_show+0x86/0x90 (fs/xfs/xfs_sysfs.c:724)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x20c/0x410
kasan_report+0xdd/0x110
sysfs_kf_seq_show+0x1bd/0x380
seq_read_iter+0x40f/0x11b0
lock_release+0xba/0x260
mark_held_locks+0x40/0x70
vfs_read+0x717/0xce0
__up_read+0x319/0x900
ksys_read+0xf8/0x1c0
do_user_addr_fault+0x3d0/0xbc0
trace_hardirqs_on_prepare+0x23/0xf0
do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x74/0x7c
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x205/0x460
xfs_mount_zones+0x34c/0x2650
xfs_mountfs+0x1b97/0x1eb0
xfs_fs_fill_super+0xf2b/0x18a0
get_tree_bdev_flags+0x310/0x590
vfs_get_tree+0x8d/0x2e0
__x64_sys_fsconfig+0x61c/0xbc0
do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x74/0x7c
Freed by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x20e/0x4c0
xfs_unmountfs+0x2fd/0x390
xfs_fs_put_super+0x60/0x110
generic_shutdown_super+0x143/0x4b0
kill_block_super+0x3b/0x90
xfs_kill_sb+0x12/0x50
deactivate_locked_super+0xa7/0x160
cleanup_mnt+0x218/0x420
task_work_run+0x11a/0x1f0
exit_to_user_mode_loop+0x13c/0x4f0
do_syscall_64+0x4a9/0x530 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x74/0x7c
Fixes: 62c89988dc19 ("xfs: expose the number of open zones in sysfs")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
fs/xfs/xfs_sysfs.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
index 676777064c2d..1fe0014c8567 100644
--- a/fs/xfs/xfs_sysfs.c
+++ b/fs/xfs/xfs_sysfs.c
@@ -725,9 +725,21 @@ nr_open_zones_show(
struct kobject *kobj,
char *buf)
{
- struct xfs_zone_info *zi = zoned_to_mp(kobj)->m_zone_info;
+ struct xfs_mount *mp = zoned_to_mp(kobj);
+ struct xfs_zone_info *zi;
+ ssize_t ret;
+
+ if (!down_read_trylock(&mp->m_super->s_umount))
+ return -ENODEV;
+
+ zi = mp->m_zone_info;
+ if (zi)
+ ret = sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
+ else
+ ret = -ENODEV;
+ up_read(&mp->m_super->s_umount);
- return sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
+ return ret;
}
XFS_SYSFS_ATTR_RO(nr_open_zones);
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] xfs: serialize zoned sysfs reads against unmount
2026-07-02 15:01 [PATCH] xfs: serialize zoned sysfs reads against unmount Cen Zhang
@ 2026-07-02 15:34 ` Darrick J. Wong
2026-07-02 15:46 ` Cen Zhang
0 siblings, 1 reply; 3+ messages in thread
From: Darrick J. Wong @ 2026-07-02 15:34 UTC (permalink / raw)
To: Cen Zhang
Cc: Carlos Maiolino, Hans Holmberg, Damien Le Moal, linux-xfs,
linux-kernel, baijiaju1990
On Thu, Jul 02, 2026 at 11:01:33PM +0800, Cen Zhang wrote:
> The zoned sysfs kobject is removed late in xfs_unmountfs(), after
> xfs_unmount_zones() has torn down the zone allocator. A read of
> nr_open_zones can therefore enter through the still-live sysfs kobject
> and dereference mp->m_zone_info after xfs_free_zone_info() has freed it.
>
> Serialize the nr_open_zones show method against unmount with s_umount.
> If unmount already owns the write side, fail the sysfs read before
> touching m_zone_info. If the sysfs read gets in first, the unmount path
> must wait until the read has copied zi_nr_open_zones. Also return
> -ENODEV if the zoned sysfs node is visible before zone information is
> available.
Shouldn't we tear down the sysfs files that access m_zone_info before
freeing it?
--D
> Validation reproduced this kernel report:
> BUG: KASAN: slab-use-after-free in nr_open_zones_show+0x86/0x90
> The buggy address belongs to the object at ffff88810b177800 which belongs
> to the cache kmalloc-1k of size 1024
> The buggy address is located 160 bytes inside of freed 1024-byte region
> [ffff88810b177800, ffff88810b177c00)
> Read of size 4
> Call trace:
> print_report+0xcd/0x620
> nr_open_zones_show+0x86/0x90 (fs/xfs/xfs_sysfs.c:724)
> srso_alias_return_thunk+0x5/0xfbef5
> __virt_addr_valid+0x20c/0x410
> kasan_report+0xdd/0x110
> sysfs_kf_seq_show+0x1bd/0x380
> seq_read_iter+0x40f/0x11b0
> lock_release+0xba/0x260
> mark_held_locks+0x40/0x70
> vfs_read+0x717/0xce0
> __up_read+0x319/0x900
> ksys_read+0xf8/0x1c0
> do_user_addr_fault+0x3d0/0xbc0
> trace_hardirqs_on_prepare+0x23/0xf0
> do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
> entry_SYSCALL_64_after_hwframe+0x74/0x7c
> Allocated by task stack:
> kasan_save_stack+0x33/0x60
> kasan_save_track+0x14/0x30
> __kasan_kmalloc+0xaa/0xb0
> __kmalloc_cache_noprof+0x205/0x460
> xfs_mount_zones+0x34c/0x2650
> xfs_mountfs+0x1b97/0x1eb0
> xfs_fs_fill_super+0xf2b/0x18a0
> get_tree_bdev_flags+0x310/0x590
> vfs_get_tree+0x8d/0x2e0
> __x64_sys_fsconfig+0x61c/0xbc0
> do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
> entry_SYSCALL_64_after_hwframe+0x74/0x7c
> Freed by task stack:
> kasan_save_stack+0x33/0x60
> kasan_save_track+0x14/0x30
> kasan_save_free_info+0x3b/0x60
> __kasan_slab_free+0x5f/0x80
> kfree+0x20e/0x4c0
> xfs_unmountfs+0x2fd/0x390
> xfs_fs_put_super+0x60/0x110
> generic_shutdown_super+0x143/0x4b0
> kill_block_super+0x3b/0x90
> xfs_kill_sb+0x12/0x50
> deactivate_locked_super+0xa7/0x160
> cleanup_mnt+0x218/0x420
> task_work_run+0x11a/0x1f0
> exit_to_user_mode_loop+0x13c/0x4f0
> do_syscall_64+0x4a9/0x530 (arch/x86/entry/syscall_64.c:87)
> entry_SYSCALL_64_after_hwframe+0x74/0x7c
>
> Fixes: 62c89988dc19 ("xfs: expose the number of open zones in sysfs")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
> ---
> fs/xfs/xfs_sysfs.c | 16 ++++++++++++++--
> 1 file changed, 14 insertions(+), 2 deletions(-)
>
> diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
> index 676777064c2d..1fe0014c8567 100644
> --- a/fs/xfs/xfs_sysfs.c
> +++ b/fs/xfs/xfs_sysfs.c
> @@ -725,9 +725,21 @@ nr_open_zones_show(
> struct kobject *kobj,
> char *buf)
> {
> - struct xfs_zone_info *zi = zoned_to_mp(kobj)->m_zone_info;
> + struct xfs_mount *mp = zoned_to_mp(kobj);
> + struct xfs_zone_info *zi;
> + ssize_t ret;
> +
> + if (!down_read_trylock(&mp->m_super->s_umount))
> + return -ENODEV;
> +
> + zi = mp->m_zone_info;
> + if (zi)
> + ret = sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
> + else
> + ret = -ENODEV;
> + up_read(&mp->m_super->s_umount);
>
> - return sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
> + return ret;
> }
> XFS_SYSFS_ATTR_RO(nr_open_zones);
>
> --
> 2.43.0
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-02 15:46 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-02 15:01 [PATCH] xfs: serialize zoned sysfs reads against unmount Cen Zhang
2026-07-02 15:34 ` Darrick J. Wong
2026-07-02 15:46 ` Cen Zhang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox