Re: [PATCH v6 08/10] fs/resctrl: Prevent deadlock and use-after-free in info file handlers

[Luck, Tony]

On Mon, Jul 06, 2026 at 03:46:28PM -0700, Reinette Chatre wrote:

Internal AI noted a couple of extra blank lines introduced by this
patch. See below.

> resctrl provides files under the info/ directory to expose global
> configuration and capabilities to userspace. These files are instantiated
> statically during filesystem mount and expose data associated with internal
> schema structures via kernfs private pointers.
> 
> A potential deadlock exists between userspace readers of these info files
> and the unmount filesystem teardown process. Reading an info file invokes
> kernfs which acquires an active reference, after which the handler typically
> attempts to acquire the rdtgroup_mutex. Concurrently, unmounting the
> filesystem holds the rdtgroup_mutex and then attempts to recursively
> remove the info kernfs nodes involving kernfs_drain() which blocks until
> all active references are released. Another problem exists where info files
> might be accessed from an outdated mount if the filesystem is unmounted and
> remounted during a reader's execution, leading to a use-after-free when
> reading the now-deleted private schema data.
> 
> Introduce info_kn_lock() and info_kn_unlock() helpers to coordinate locking
> across all info handlers. These helpers mirror similar logic used by resource
> group handlers by deliberately breaking the kernfs active protection before
> attempting to acquire the rdtgroup_mutex, preventing the deadlock. To guard
> against the vulnerability from rapid mount cycling, info_kn_lock() securely
> walks the parent lineage of the kernfs node under an RCU section to confirm
> the node belongs to the globally active root before permitting the operation
> to proceed. Convert all info file handlers to use this helper and only
> de-reference the schema after it is determined safe to do so.
> 
> Make no attempt to output an error message to last_cmd_status on failure
> since failure implies there is no filesystem with which to display the error
> to user space.
> 
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260515193944.15114-1-tony.luck%40intel.com?part=3
> Assisted-by: GitHub_Copilot:gemini-3.1-pro
> Signed-off-by: Reinette Chatre <reinette.chatre@xxxxxxxxx>
> Reviewed-by: Tony Luck <tony.luck@xxxxxxxxx>
> ---
> Changes since V2:
> - New patch
> 
> Changes since V3:
> - Add Tony's Reviewed-by tag.
> - Changelog grammar fixes.

...

> @@ -1020,9 +1030,15 @@ static int rdt_min_cbm_bits_show(struct kernfs_open_file *of,
>  				 struct seq_file *seq, void *v)
>  {
>  	struct resctrl_schema *s = rdt_kn_parent_priv(of->kn);
> -	struct rdt_resource *r = s->res;
> +	struct rdt_resource *r;
> +

Extra blank line added here.
>  
> +	if (!info_kn_lock(of->kn))
> +		return -ENOENT;
> +	r = s->res;
>  	seq_printf(seq, "%u\n", r->cache.min_cbm_bits);
> +	info_kn_unlock(of->kn);
> +
>  	return 0;
>  }
>  

...

> @@ -1652,8 +1718,8 @@ static int mbm_config_show(struct seq_file *s, struct rdt_resource *r, u32 evtid
>  	struct rdt_l3_mon_domain *dom;
>  	bool sep = false;
>  
> -	cpus_read_lock();
> -	mutex_lock(&rdtgroup_mutex);
> +	lockdep_assert_cpus_held();
> +	lockdep_assert_held(&rdtgroup_mutex);
>  
>  	list_for_each_entry_rcu(dom, &r->mon_domains, hdr.list, lockdep_is_cpus_held()) {
>  		if (sep)
> @@ -1670,8 +1736,6 @@ static int mbm_config_show(struct seq_file *s, struct rdt_resource *r, u32 evtid
>  	}
>  	seq_puts(s, "\n");
>  
> -	mutex_unlock(&rdtgroup_mutex);
> -	cpus_read_unlock();
>  

Extra blank line here after deleting those two lines.

>  	return 0;
>  }

-Tony