From nobody Sat Jul 25 19:29:01 2026 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 497CE391E73 for ; Tue, 14 Jul 2026 11:53:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030009; cv=none; b=cx8LBwMfh9j08phmu4ajyd2MCDBPITdpKp3ryHVzTrWBTdKAxmVWRd6WXMroJEXphlDue3IoYctyRDCKgxwXMsdM67H1jMKg5p8ta6RT4MbFEDpd6nwbAr7IYsp9rnUWcXf+KaA2BZ5Q6Lcy+9YXDtyYzdSksqFEL9UhUWu+x2o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784030009; c=relaxed/simple; bh=uEJvVCkmHOvFYP+eSvMNv8ZhynMnE8aWkYiTYUJgs7A=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=QINGfOtDENFdpdTiFRa9wTLoNdRP3mE6fQF2oGKIiVJKw1T5qYX5D7vNHdcyND5ApaUoqHlhb1wleDKDs2kccqoeon0rCgFH0IyDpa4sBznc29xyU0uoD1EypmIPwfwrrNNkIguTO4X3S+3Fp/CrTqH5UvIW1dSGP/TSKPeYGS0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SUtPVSTz; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SUtPVSTz" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-38a0c7e841fso965868a91.2 for ; Tue, 14 Jul 2026 04:53:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784030008; x=1784634808; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=EM2CA/sZkLiaC+4R5X6O7VrwHDInDWut6K0oPFdflpY=; b=SUtPVSTzQALSFnCitUxCvA9E6/jbioLWGiuCIeur4rLR5/pJ8YohGLYXPz9QBBG9eQ KX691p17VNMdSgZIeSTWpiP2kFdT1jpSSIxvV4mrp8juHfovNxXaZw88+FeqZSnlEn5G aY0zifIfur9mknynu+34KiNmSUyIQb4XZLiTRFfOKfgAw5O3wrTbyCaAsGW/V1ZTACRg HbhyzgYf2hycleiaqE4kDbhI/HwueisdRofRPbb+oTgCDebnkRA954+zEsXFi/737wGE pKWgyroO+uY3I9x4/4JVSIA+gzF5SX30x/bjDAGCeMTKGuvpRhZv2HZKb7rUnuoW6wzz Tj1A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784030008; x=1784634808; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EM2CA/sZkLiaC+4R5X6O7VrwHDInDWut6K0oPFdflpY=; b=RRklDEcKgV6hoJTFUIjMvQXUIn9iPsjsOfK+RmSxTUC9T6uf+gg2sJWTr1Wd1qa6cg S/J+lIkqm5rkrjeHLHhWoI6OhreNYI5/XUlBPhFv0m+vrpnWQ4ZcIRumhHhY2vUo8E8B lszNKZHW2j6L9fDtsVrIiqhDwDqSkPXvxT499YgT/DLv8AH0aaAIceD6hrHCXXOIda0m 40GLnJxK9+J2TGtsELPfn9tDUwOoBIH3XjGUJxrDDssh5rrNrmx7XuRLAKi1cSuTVEZv I5tU3TcHhi5dUfWn1R0S87AQRI/XalMzaW3+wUghxNMT+H7DnC246+myhAzBUspcDdBS HQFg== X-Forwarded-Encrypted: i=1; AHgh+RoC7h5+idOFPmdRwdRTFLchbemD58MNanY4wf7o2ASy1Pu5XojaUeQhtzlJjruTiP7cQaqKMpr2hK/zEYM=@vger.kernel.org X-Gm-Message-State: AOJu0YwSJzG7n22IeD64U0TQRuU/KDvZIys02TsnCkgVCNY7VWOj64ju HoG+sO0nyiu+yEugR4duS6EYL0R9DM4J9OLfEZ2wPZOLMAwE767DYZSV X-Gm-Gg: AfdE7clujNznJWbJ6axOhsCnPUWjZpBaEE3vHghXcZ3S2M4oimAIMY10XlDAzo/gfiF 0rgEt7Fbcy5ps6vrtt2f8Ws4HBs/kWqTGr49WHaZ14lcdXmMkOU9xTK2z98KVSLUKKb1rtQHl7a h2EvGn5iU9j+JsiX8JSDALa8fQHnYwkdB51Hdatv1q+aPRCiJi511faHbLXKJsWZ3F7NLr+dd4+ OZZiqKgPvwh5pcmEElG0KNuiam/nU1vJBPKPZNI16zVnfyTDbDJF5HpleQVXkZigaGYfJ1xJbDm Ug/qm+HEYwjzjTLvSXT+uFTkOV+FiwJyNFml535MP2RKRUn3QuJBFd5kUBxeIHeid23Xpl3CG8+ eKmeogN09HvIkn2iQD76BsbMPlSVj6Eh+wgM72PF5tMF6/dMJ5DrkgoTUKqVTt4PSN7qQjFbFct aiqqKPsA== X-Received: by 2002:a17:90b:35c4:b0:381:21c1:75c0 with SMTP id 98e67ed59e1d1-38dc74cfa71mr12709581a91.15.1784030007543; Tue, 14 Jul 2026 04:53:27 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cef8852e68sm4073615ad.37.2026.07.14.04.53.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 04:53:27 -0700 (PDT) From: Guangshuo Li To: "Md. Haris Iqbal" , Jack Wang , Jens Axboe , Danil Kipnis , Jason Gunthorpe , Bart Van Assche , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] block/rnbd: Fix double free in process_msg_open Date: Tue, 14 Jul 2026 19:50:51 +0800 Message-ID: <20260714115051.1401174-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" process_msg_open() allocates srv_sess_dev with rnbd_srv_create_set_sess_dev() and then initializes its embedded kobject through rnbd_srv_create_dev_session_sysfs(). If sysfs creation fails, the helper calls kobject_put(). The final put invokes rnbd_srv_sess_dev_release(), which reaches rnbd_destroy_sess_dev() and frees srv_sess_dev. process_msg_open() then jumps to free_srv_sess_dev and calls kfree() on the same object again, resulting in a double free. Add the session device to the list and release srv_dev->lock before creating the sysfs entries. On failure, rely on the kobject release callback as the sole owner of the cleanup instead of freeing the object again. This issue was found by a static analysis tool I am developing. Fixes: 8cee532f469b ("block/rnbd: server: sysfs interface functions") Signed-off-by: Guangshuo Li Acked-by: Jack Wang --- drivers/block/rnbd/rnbd-srv.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index 10e8c438bb43..5a991bfbf3ad 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -778,18 +778,22 @@ static int process_msg_open(struct rnbd_srv_session *= srv_sess, } } =20 + /* + * Add the session device to the list before initializing its + * kobject. If sysfs creation fails, kobject_put() invokes the + * release callback, which removes the object from this list and + * releases all resources associated with the session device. + */ + list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list); + mutex_unlock(&srv_dev->lock); + ret =3D rnbd_srv_create_dev_session_sysfs(srv_sess_dev); if (ret) { - mutex_unlock(&srv_dev->lock); - rnbd_srv_err(srv_sess_dev, - "Opening device failed, failed to create dev client sysfs files, = err: %d\n", - ret); - goto free_srv_sess_dev; + pr_err("Opening device '%s' on session %s failed, failed to create dev c= lient sysfs files, err: %d\n", + full_path, srv_sess->sessname, ret); + goto free_path; } =20 - list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list); - mutex_unlock(&srv_dev->lock); - rnbd_srv_info(srv_sess_dev, "Opened device '%s'\n", srv_dev->name); =20 kfree(full_path); --=20 2.43.0