process_msg_close() drops the device reference with rnbd_put_sess_dev()
before using sess_dev again in rnbd_srv_destroy_dev_session_sysfs().
If that put drops the last kref, e.g. when the device is concurrently
being torn down through rnbd_srv_sess_dev_force_close(), the waiter in
rnbd_destroy_sess_dev() is woken up and frees sess_dev, so the
subsequent rnbd_srv_destroy_dev_session_sysfs() call operates on freed
memory.

Move the rnbd_put_sess_dev() call after the sysfs teardown so it is the
last access to sess_dev.

Fixes: 2de6c8de192b ("block/rnbd: server: main functionality")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/block/rnbd/rnbd-srv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
index 10e8c438bb43..2ebc2eac384f 100644
--- a/drivers/block/rnbd/rnbd-srv.c
+++ b/drivers/block/rnbd/rnbd-srv.c
@@ -361,10 +361,10 @@ static void process_msg_close(struct rnbd_srv_session *srv_sess,
 	if (IS_ERR(sess_dev))
 		return;
 
-	rnbd_put_sess_dev(sess_dev);
 	mutex_lock(&srv_sess->lock);
 	rnbd_srv_destroy_dev_session_sysfs(sess_dev);
 	mutex_unlock(&srv_sess->lock);
+	rnbd_put_sess_dev(sess_dev);
 }
 
 static int process_msg_open(struct rnbd_srv_session *srv_sess,
-- 
2.34.1

On Wed, Sep 16, 2026 at 11:48 AM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> process_msg_close() drops the device reference with rnbd_put_sess_dev()
> before using sess_dev again in rnbd_srv_destroy_dev_session_sysfs().
> If that put drops the last kref, e.g. when the device is concurrently
> being torn down through rnbd_srv_sess_dev_force_close(), the waiter in
> rnbd_destroy_sess_dev() is woken up and frees sess_dev, so the
> subsequent rnbd_srv_destroy_dev_session_sysfs() call operates on freed
> memory.
>
> Move the rnbd_put_sess_dev() call after the sysfs teardown so it is the
> last access to sess_dev.
>
> Fixes: 2de6c8de192b ("block/rnbd: server: main functionality")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/block/rnbd/rnbd-srv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
> index 10e8c438bb43..2ebc2eac384f 100644
> --- a/drivers/block/rnbd/rnbd-srv.c
> +++ b/drivers/block/rnbd/rnbd-srv.c
> @@ -361,10 +361,10 @@ static void process_msg_close(struct rnbd_srv_session *srv_sess,
>         if (IS_ERR(sess_dev))
>                 return;
>
> -       rnbd_put_sess_dev(sess_dev);
>         mutex_lock(&srv_sess->lock);
>         rnbd_srv_destroy_dev_session_sysfs(sess_dev);
>         mutex_unlock(&srv_sess->lock);
> +       rnbd_put_sess_dev(sess_dev);

Thanks for the patch.

Sashiko has critical finding about this change.
https://sashiko.dev/#/patchset/20260916094817.2007756-1-vulab%40iscas.ac.cn

Can you please review that?

>  }
>
>  static int process_msg_open(struct rnbd_srv_session *srv_sess,
> --
> 2.34.1
>


-- 

Regards
-Haris