> The virtio_fs object is refcounted via its kobject, so a mount can keep it
> alive well beyond the lifetime of the virtio device binding. The tag
> string, however, was allocated with devm_kmalloc() and is therefore freed
> by devres_release_all() as soon as the device is unbound, i.e. right after
> virtio_fs_remove() returns (see device_unbind_cleanup() in
> drivers/base/dd.c).
>
> virtio_fs_get_tree() looks up the instance, takes a kobject reference and
> then drops virtio_fs_mutex before doing the sleepable part of the mount
> (allocations, fuse_conn_init(), sget_fc()). A concurrent device removal
> can complete in that window:
>
> CPU 0 (mount) CPU 1 (remove)
> ------------- --------------
> virtio_fs_get_tree()
> [ ... ]
> Fixes: a62a8ef9d97d ("virtio-fs: add virtiofs filesystem")
> Cc: <[email protected]>
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/bug/linux-0328b3a1-043b-468e-8425-6a613d91b5ef
> Signed-off-by: Miklos Szeredi <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
