Re: [PATCH] block/rnbd: Fix double free in process_msg_open

On Tue, Jul 14, 2026 at 1:53 PM Guangshuo Li <[email protected]> wrote:
>
> process_msg_open() allocates srv_sess_dev with
> rnbd_srv_create_set_sess_dev() and then initializes its embedded kobject
> through rnbd_srv_create_dev_session_sysfs().
>
> If sysfs creation fails, the helper calls kobject_put(). The final put
> invokes rnbd_srv_sess_dev_release(), which reaches
> rnbd_destroy_sess_dev() and frees srv_sess_dev. process_msg_open() then
> jumps to free_srv_sess_dev and calls kfree() on the same object again,
> resulting in a double free.
>
> Add the session device to the list and release srv_dev->lock before
> creating the sysfs entries. On failure, rely on the kobject release
> callback as the sole owner of the cleanup instead of freeing the object
> again.
>
> This issue was found by a static analysis tool I am developing.
>
> Fixes: 8cee532f469b ("block/rnbd: server: sysfs interface functions")
> Signed-off-by: Guangshuo Li <[email protected]>
lgtm.
Acked-by: Jack Wang <[email protected]>
> ---
>  drivers/block/rnbd/rnbd-srv.c | 20 ++++++++++++--------
>  1 file changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
> index 10e8c438bb43..5a991bfbf3ad 100644
> --- a/drivers/block/rnbd/rnbd-srv.c
> +++ b/drivers/block/rnbd/rnbd-srv.c
> @@ -778,18 +778,22 @@ static int process_msg_open(struct rnbd_srv_session *srv_sess,
>                 }
>         }
>
> +       /*
> +        * Add the session device to the list before initializing its
> +        * kobject. If sysfs creation fails, kobject_put() invokes the
> +        * release callback, which removes the object from this list and
> +        * releases all resources associated with the session device.
> +        */
> +       list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
> +       mutex_unlock(&srv_dev->lock);
> +
>         ret = rnbd_srv_create_dev_session_sysfs(srv_sess_dev);
>         if (ret) {
> -               mutex_unlock(&srv_dev->lock);
> -               rnbd_srv_err(srv_sess_dev,
> -                             "Opening device failed, failed to create dev client sysfs files, err: %d\n",
> -                             ret);
> -               goto free_srv_sess_dev;
> +               pr_err("Opening device '%s' on session %s failed, failed to create dev client sysfs files, err: %d\n",
> +                      full_path, srv_sess->sessname, ret);
> +               goto free_path;
>         }
>
> -       list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
> -       mutex_unlock(&srv_dev->lock);
> -
>         rnbd_srv_info(srv_sess_dev, "Opened device '%s'\n", srv_dev->name);
>
>         kfree(full_path);
> --
> 2.43.0
>