Re: [PATCH] xfs: serialize zoned sysfs reads against unmount

[Darrick J. Wong]

On Thu, Jul 02, 2026 at 11:01:33PM +0800, Cen Zhang wrote:
> The zoned sysfs kobject is removed late in xfs_unmountfs(), after
> xfs_unmount_zones() has torn down the zone allocator.  A read of
> nr_open_zones can therefore enter through the still-live sysfs kobject
> and dereference mp->m_zone_info after xfs_free_zone_info() has freed it.
> 
> Serialize the nr_open_zones show method against unmount with s_umount.
> If unmount already owns the write side, fail the sysfs read before
> touching m_zone_info.  If the sysfs read gets in first, the unmount path
> must wait until the read has copied zi_nr_open_zones.  Also return
> -ENODEV if the zoned sysfs node is visible before zone information is
> available.

Shouldn't we tear down the sysfs files that access m_zone_info before
freeing it?

--D

> Validation reproduced this kernel report:
> BUG: KASAN: slab-use-after-free in nr_open_zones_show+0x86/0x90
> The buggy address belongs to the object at ffff88810b177800 which belongs
> to the cache kmalloc-1k of size 1024
> The buggy address is located 160 bytes inside of freed 1024-byte region
> [ffff88810b177800, ffff88810b177c00)
> Read of size 4
> Call trace:
>   print_report+0xcd/0x620
>   nr_open_zones_show+0x86/0x90 (fs/xfs/xfs_sysfs.c:724)
>   srso_alias_return_thunk+0x5/0xfbef5
>   __virt_addr_valid+0x20c/0x410
>   kasan_report+0xdd/0x110
>   sysfs_kf_seq_show+0x1bd/0x380
>   seq_read_iter+0x40f/0x11b0
>   lock_release+0xba/0x260
>   mark_held_locks+0x40/0x70
>   vfs_read+0x717/0xce0
>   __up_read+0x319/0x900
>   ksys_read+0xf8/0x1c0
>   do_user_addr_fault+0x3d0/0xbc0
>   trace_hardirqs_on_prepare+0x23/0xf0
>   do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
>   entry_SYSCALL_64_after_hwframe+0x74/0x7c
> Allocated by task stack:
>   kasan_save_stack+0x33/0x60
>   kasan_save_track+0x14/0x30
>   __kasan_kmalloc+0xaa/0xb0
>   __kmalloc_cache_noprof+0x205/0x460
>   xfs_mount_zones+0x34c/0x2650
>   xfs_mountfs+0x1b97/0x1eb0
>   xfs_fs_fill_super+0xf2b/0x18a0
>   get_tree_bdev_flags+0x310/0x590
>   vfs_get_tree+0x8d/0x2e0
>   __x64_sys_fsconfig+0x61c/0xbc0
>   do_syscall_64+0xc8/0x530 (arch/x86/entry/syscall_64.c:87)
>   entry_SYSCALL_64_after_hwframe+0x74/0x7c
> Freed by task stack:
>   kasan_save_stack+0x33/0x60
>   kasan_save_track+0x14/0x30
>   kasan_save_free_info+0x3b/0x60
>   __kasan_slab_free+0x5f/0x80
>   kfree+0x20e/0x4c0
>   xfs_unmountfs+0x2fd/0x390
>   xfs_fs_put_super+0x60/0x110
>   generic_shutdown_super+0x143/0x4b0
>   kill_block_super+0x3b/0x90
>   xfs_kill_sb+0x12/0x50
>   deactivate_locked_super+0xa7/0x160
>   cleanup_mnt+0x218/0x420
>   task_work_run+0x11a/0x1f0
>   exit_to_user_mode_loop+0x13c/0x4f0
>   do_syscall_64+0x4a9/0x530 (arch/x86/entry/syscall_64.c:87)
>   entry_SYSCALL_64_after_hwframe+0x74/0x7c
> 
> Fixes: 62c89988dc19 ("xfs: expose the number of open zones in sysfs")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> ---
>  fs/xfs/xfs_sysfs.c | 16 ++++++++++++++--
>  1 file changed, 14 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/xfs/xfs_sysfs.c b/fs/xfs/xfs_sysfs.c
> index 676777064c2d..1fe0014c8567 100644
> --- a/fs/xfs/xfs_sysfs.c
> +++ b/fs/xfs/xfs_sysfs.c
> @@ -725,9 +725,21 @@ nr_open_zones_show(
>  	struct kobject		*kobj,
>  	char			*buf)
>  {
> -	struct xfs_zone_info	*zi = zoned_to_mp(kobj)->m_zone_info;
> +	struct xfs_mount	*mp = zoned_to_mp(kobj);
> +	struct xfs_zone_info	*zi;
> +	ssize_t			ret;
> +
> +	if (!down_read_trylock(&mp->m_super->s_umount))
> +		return -ENODEV;
> +
> +	zi = mp->m_zone_info;
> +	if (zi)
> +		ret = sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
> +	else
> +		ret = -ENODEV;
> +	up_read(&mp->m_super->s_umount);
>  
> -	return sysfs_emit(buf, "%u\n", READ_ONCE(zi->zi_nr_open_zones));
> +	return ret;
>  }
>  XFS_SYSFS_ATTR_RO(nr_open_zones);
>  
> -- 
> 2.43.0
> 
>