[PATCH] btrfs: remove devid kobject when deleting a missing device

[PATCH] btrfs: remove devid kobject when deleting a missing device

[Cheng Yongkang]

btrfs_rm_device() removes the sysfs device entry only when
device->bdev_file is non-NULL.  A missing device (created by
add_missing_dev() for an absent disk) has bdev_file == NULL, but
btrfs_sysfs_add_device() still registers its devid kobject under
/sys/fs/btrfs/<uuid>/devinfo/<devid>.

When such a device is deleted, btrfs_free_device() frees the
btrfs_device while the devid kobject remains registered.  The kobject
is embedded in the freed btrfs_device and its show functions use
container_of() to reach it, so reading any devinfo attribute is a
use-after-free:

  BUG: KASAN: slab-use-after-free in sysfs_kf_seq_show+0x157/0x490
  Read of size 8 at addr ffff88801d8172a8 by task poc/9385
  ...
  Freed by task 9385:
   kfree
   btrfs_rm_device+0x11ee/0x17b0
   btrfs_ioctl_rm_dev+0x265/0x400
  Allocated by task 9390:
   btrfs_alloc_device+0x7e/0x400
   device_list_add
   btrfs_scan_one_device
   btrfs_control_ioctl

The freed object is kmalloc-1k and the faulting access is 680 bytes
inside it (offsetof(struct btrfs_device, devid_kobj) = 640 plus
offsetof(struct kobject, ktype) = 40), confirming the embedded
devid_kobj.

Reproducer: create a three-device RAID1 btrfs, detach one device,
mount with -o degraded, delete the missing device with
BTRFS_IOC_RM_DEV("missing"), then read
/sys/fs/btrfs/<uuid>/devinfo/<devid>/fsid.

btrfs_sysfs_remove_device() already skips the block-device link when
device->bdev is NULL and only touches the devid kobject when it is
initialized.  Call it for missing devices too.

Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 fs/btrfs/volumes.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 85ea9c5..912a1ef 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2479,11 +2479,11 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info,
 
 	btrfs_assign_next_active_device(device, NULL);
 
-	if (device->bdev_file) {
+	if (device->bdev_file)
 		cur_devices->open_devices--;
-		/* remove sysfs entry */
-		btrfs_sysfs_remove_device(device);
-	}
+
+	/* remove sysfs entry, including for a missing device */
+	btrfs_sysfs_remove_device(device);
 
 	num_devices = btrfs_super_num_devices(fs_info->super_copy) - 1;
 	btrfs_set_super_num_devices(fs_info->super_copy, num_devices);
-- 
2.34.1

Re: [PATCH] btrfs: remove devid kobject when deleting a missing device

[Qu Wenruo]

在 2026/10/26 04:32, Cheng Yongkang 写道:
> btrfs_rm_device() removes the sysfs device entry only when
> device->bdev_file is non-NULL.  A missing device (created by
> add_missing_dev() for an absent disk) has bdev_file == NULL, but
> btrfs_sysfs_add_device() still registers its devid kobject under
> /sys/fs/btrfs/<uuid>/devinfo/<devid>.
> 
> When such a device is deleted, btrfs_free_device() frees the
> btrfs_device while the devid kobject remains registered.  The kobject
> is embedded in the freed btrfs_device and its show functions use
> container_of() to reach it, so reading any devinfo attribute is a
> use-after-free:
> 
>    BUG: KASAN: slab-use-after-free in sysfs_kf_seq_show+0x157/0x490
>    Read of size 8 at addr ffff88801d8172a8 by task poc/9385
>    ...
>    Freed by task 9385:
>     kfree
>     btrfs_rm_device+0x11ee/0x17b0
>     btrfs_ioctl_rm_dev+0x265/0x400
>    Allocated by task 9390:
>     btrfs_alloc_device+0x7e/0x400
>     device_list_add
>     btrfs_scan_one_device
>     btrfs_control_ioctl
> 
> The freed object is kmalloc-1k and the faulting access is 680 bytes
> inside it (offsetof(struct btrfs_device, devid_kobj) = 640 plus
> offsetof(struct kobject, ktype) = 40), confirming the embedded
> devid_kobj.
> 
> Reproducer: create a three-device RAID1 btrfs, detach one device,
> mount with -o degraded, delete the missing device with
> BTRFS_IOC_RM_DEV("missing"), then read
> /sys/fs/btrfs/<uuid>/devinfo/<devid>/fsid.
> 
> btrfs_sysfs_remove_device() already skips the block-device link when
> device->bdev is NULL and only touches the devid kobject when it is
> initialized.  Call it for missing devices too.
> 
> Assisted-by: LLM
> Signed-off-by: Cheng Yongkang <teel4res@gmail.com>

Reviewed-by: Qu Wenruo <wqu@suse.com>

> ---
>   fs/btrfs/volumes.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
> index 85ea9c5..912a1ef 100644
> --- a/fs/btrfs/volumes.c
> +++ b/fs/btrfs/volumes.c
> @@ -2479,11 +2479,11 @@ int btrfs_rm_device(struct btrfs_fs_info *fs_info,
>   
>   	btrfs_assign_next_active_device(device, NULL);
>   
> -	if (device->bdev_file) {
> +	if (device->bdev_file)
>   		cur_devices->open_devices--;
> -		/* remove sysfs entry */
> -		btrfs_sysfs_remove_device(device);
> -	}
> +
> +	/* remove sysfs entry, including for a missing device */
> +	btrfs_sysfs_remove_device(device);
>   
>   	num_devices = btrfs_super_num_devices(fs_info->super_copy) - 1;
>   	btrfs_set_super_num_devices(fs_info->super_copy, num_devices);