From 0344a9492efac4c79202a07cf284a382f7054170 Mon Sep 17 00:00:00 2001 From: Binbin Deng <18983559317@163.com> Date: Thu, 15 Oct 2026 16:02:25 +0800 Subject: [PATCH] xfs: set healthmon mount cookie before publishing it xfs_ioc_health_monitor() allocates the healthmon object with kzalloc(), so mount_cookie starts as zero. zero is also DETACHED_MOUNT_COOKIE, but xfs_healthmon_attach() publishes hm through mp->m_healthmon before storing the mount cookie. A concurrent reporter can therefore acquire hm from xfs_healthmon_get(), see the detached cookie in xfs_healthmon_push(), and drop the event even though the monitor is being attached. This is reachable by racing XFS_IOC_HEALTH_MONITOR with an operation that reports a health event, such as a filesystem shutdown. Initialize the mount cookie before making hm visible through the RCU pointer so reporters always observe an attached monitor. Found during a static-analysis-assisted audit: candidate sites were surfaced by a Coccinelle rule, and the reader/writer paths were confirmed by LLM-assisted (GLM-5.3) code inspection. The issue was not observed at runtime; it is identified by code inspection only. Fixes: a48373e7d35a ("xfs: start creating infrastructure for health monitoring") Cc: stable@vger.kernel.org Signed-off-by: Binbin Deng <18983559317@163.com> Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino --- fs/xfs/xfs_healthmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xfs/xfs_healthmon.c b/fs/xfs/xfs_healthmon.c index 2bdd747f1ead..05d6f0494139 100644 --- a/fs/xfs/xfs_healthmon.c +++ b/fs/xfs/xfs_healthmon.c @@ -114,8 +114,8 @@ xfs_healthmon_attach( } refcount_inc(&hm->ref); - rcu_assign_pointer(mp->m_healthmon, hm); hm->mount_cookie = (uintptr_t)mp->m_super; + rcu_assign_pointer(mp->m_healthmon, hm); spin_unlock(&xfs_healthmon_lock); return 0;