[PATCH v1] xfs: set healthmon mount cookie before publishing it

[PATCH v1] xfs: set healthmon mount cookie before publishing it

[Binbin Deng]

xfs_ioc_health_monitor() allocates the healthmon object with kzalloc(), so
mount_cookie starts as zero.  zero is also DETACHED_MOUNT_COOKIE, but
xfs_healthmon_attach() publishes hm through mp->m_healthmon before storing
the mount cookie.  A concurrent reporter can therefore acquire hm from
xfs_healthmon_get(), see the detached cookie in xfs_healthmon_push(), and
drop the event even though the monitor is being attached.

This is reachable by racing XFS_IOC_HEALTH_MONITOR with an operation
that reports a health event, such as a filesystem shutdown.  Initialize
the mount cookie before making hm visible through the RCU pointer so
reporters always observe an attached monitor.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
not observed at runtime; it is identified by code inspection only.

Fixes: a48373e7d35a ("xfs: start creating infrastructure for health monitoring")
Cc: stable@vger.kernel.org
Signed-off-by: Binbin Deng <18983559317@163.com>
---
 fs/xfs/xfs_healthmon.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/xfs/xfs_healthmon.c b/fs/xfs/xfs_healthmon.c
index 2bdd747f1ead..05d6f0494139 100644
--- a/fs/xfs/xfs_healthmon.c
+++ b/fs/xfs/xfs_healthmon.c
@@ -114,8 +114,8 @@ xfs_healthmon_attach(
 	}
 
 	refcount_inc(&hm->ref);
-	rcu_assign_pointer(mp->m_healthmon, hm);
 	hm->mount_cookie = (uintptr_t)mp->m_super;
+	rcu_assign_pointer(mp->m_healthmon, hm);
 	spin_unlock(&xfs_healthmon_lock);
 
 	return 0;
-- 
2.43.0

Re: [PATCH v1] xfs: set healthmon mount cookie before publishing it

[Darrick J. Wong]

On Thu, Oct 15, 2026 at 04:02:25PM +0800, Binbin Deng wrote:
> xfs_ioc_health_monitor() allocates the healthmon object with kzalloc(), so
> mount_cookie starts as zero.  zero is also DETACHED_MOUNT_COOKIE, but
> xfs_healthmon_attach() publishes hm through mp->m_healthmon before storing
> the mount cookie.  A concurrent reporter can therefore acquire hm from
> xfs_healthmon_get(), see the detached cookie in xfs_healthmon_push(), and
> drop the event even though the monitor is being attached.
> 
> This is reachable by racing XFS_IOC_HEALTH_MONITOR with an operation
> that reports a health event, such as a filesystem shutdown.  Initialize
> the mount cookie before making hm visible through the RCU pointer so
> reporters always observe an attached monitor.
> 
> Found during a static-analysis-assisted audit: candidate sites were
> surfaced by a Coccinelle rule, and the reader/writer paths were
> confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
> not observed at runtime; it is identified by code inspection only.
> 
> Fixes: a48373e7d35a ("xfs: start creating infrastructure for health monitoring")
> Cc: stable@vger.kernel.org

Cc: <stable@vger.kernel.org> # v7.0

> Signed-off-by: Binbin Deng <18983559317@163.com>

Yes, we should set the mount cookie before exposing hm to the world.
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>

--D

> ---
>  fs/xfs/xfs_healthmon.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/xfs/xfs_healthmon.c b/fs/xfs/xfs_healthmon.c
> index 2bdd747f1ead..05d6f0494139 100644
> --- a/fs/xfs/xfs_healthmon.c
> +++ b/fs/xfs/xfs_healthmon.c
> @@ -114,8 +114,8 @@ xfs_healthmon_attach(
>  	}
>  
>  	refcount_inc(&hm->ref);
> -	rcu_assign_pointer(mp->m_healthmon, hm);
>  	hm->mount_cookie = (uintptr_t)mp->m_super;
> +	rcu_assign_pointer(mp->m_healthmon, hm);
>  	spin_unlock(&xfs_healthmon_lock);
>  
>  	return 0;
> -- 
> 2.43.0
> 
> 

Re: [PATCH v1] xfs: set healthmon mount cookie before publishing it

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>