Re: [PATCH] btrfs: remove devid kobject when deleting a missing device

[Qu Wenruo <quwenruo.btrfs@gmx.com>]

在 2026/10/26 04:32, Cheng Yongkang 写道:
> btrfs_rm_device() removes the sysfs device entry only when
> device->bdev_file is non-NULL.  A missing device (created by
> add_missing_dev() for an absent disk) has bdev_file == NULL, but
> btrfs_sysfs_add_device() still registers its devid kobject under
> /sys/fs/btrfs/<uuid>/devinfo/<devid>.
> 
> When such a device is deleted, btrfs_free_device() frees the
> btrfs_device while the devid kobject remains registered.  The kobject
> is embedded in the freed btrfs_device and its show functions use
> container_of() to reach it, so reading any devinfo attribute is a
> use-after-free:
> 
>    BUG: KASAN: slab-use-after-free in sysfs_kf_seq_show+0x157/0x490
>    Read of size 8 at addr ffff88801d8172a8 by task poc/9385
>    ...
>    Freed by task 9385:
>     kfree
>     btrfs_rm_device+0x11ee/0x17b0
>     btrfs_ioctl_rm_dev+0x265/0x400
>    Allocated by task 9390:
>     btrfs_alloc_device+0x7e/0x400
>     device_list_add
>     btrfs_scan_one_device
>     btrfs_control_ioctl
> 
> The freed object is kmalloc-1k and the faulting access is 680 bytes
> inside it (offsetof(struct btrfs_device, devid_kobj) = 640 plus
> offsetof(struct kobject, ktype) = 40), confirming the embedded
> devid_kobj.
> 
> Reproducer: create a three-device RAID1 btrfs, detach one device,
> mount with -o degraded, delete the missing device with
> BTRFS_IOC_RM_DEV("missing"), then read
> /sys/fs/btrfs/<uuid>/devinfo/<devid>/fsid.
> 
> btrfs_sysfs_remove_device() already skips the block-device link when
> device->bdev is NULL and only touches the devid kobject when it is
> initialized.  Call it for missing devices too.
> 
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

> ---
>   fs/btrfs/volumes.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 85ea9c5..912a1ef 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -2479,11 +2479,11 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info,
>   
>   	btrfs_assign_next_active_device(device, NULL);
>   
> -	if (device->bdev_file) {
> +	if (device->bdev_file)
>   		cur_devices->open_devices--;
> -		/* remove sysfs entry */
> -		btrfs_sysfs_remove_device(device);
> -	}
> +
> +	/* remove sysfs entry, including for a missing device */
> +	btrfs_sysfs_remove_device(device);
>   
>   	num_devices = btrfs_super_num_devices(fs_info->super_copy) - 1;
>   	btrfs_set_super_num_devices(fs_info->super_copy, num_devices);