[PATCH 0/6] Initialize device state before userspace registration

[PATCH 0/6] Initialize device state before userspace registration

[Jiale Yao]

Several drivers register character devices or sysfs attributes before
initializing synchronization objects and related state used by their
userspace entry points. Registration makes those entry points immediately
available, so a concurrent access can reach partially initialized state.

Move each initialization ahead of the corresponding registration. The
patches are independent and cover AoE, fsl-mc, MSHV, IBM VMC, DCSSBLK,
and the RDC321x watchdog.

Jiale Yao (6):
  aoe: initialize error message synchronization before registration
  bus: fsl-mc: initialize UAPI state before device registration
  Drivers: hv: initialize partition table before device registration
  misc: ibmvmc: initialize HMC state before device registration
  s390/dcssblk: initialize device semaphore before sysfs registration
  watchdog: rdc321x: initialize device state before registration

 drivers/block/aoe/aoechr.c       |  6 +++---
 drivers/bus/fsl-mc/fsl-mc-uapi.c |  6 ++----
 drivers/hv/mshv_root_main.c      |  6 +++---
 drivers/misc/ibmvmc.c            | 16 ++++++++--------
 drivers/s390/block/dcssblk.c     |  3 ++-
 drivers/watchdog/rdc321x_wdt.c   | 12 ++++++------
 6 files changed, 24 insertions(+), 25 deletions(-)

-- 
2.34.1

[PATCH 1/6] aoe: initialize error message synchronization before registration

[Jiale Yao]

register_chrdev() makes the AoE character device available before the
error message completion and lock are initialized. A userspace access
racing module initialization can therefore use either object before it
is ready.

Initialize both synchronization objects before registering the character
device.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/block/aoe/aoechr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/aoe/aoechr.c b/drivers/block/aoe/aoechr.c
index a42c4bcc85ba..efc09c97ff23 100644
--- a/drivers/block/aoe/aoechr.c
+++ b/drivers/block/aoe/aoechr.c
@@ -288,13 +288,14 @@ aoechr_init(void)
 {
 	int n, i;
 
+	init_completion(&emsgs_comp);
+	spin_lock_init(&emsgs_lock);
+
 	n = register_chrdev(AOE_MAJOR, "aoechr", &aoe_fops);
 	if (n < 0) {
 		printk(KERN_ERR "aoe: can't register char device\n");
 		return n;
 	}
-	init_completion(&emsgs_comp);
-	spin_lock_init(&emsgs_lock);
 	n = class_register(&aoe_class);
 	if (n) {
 		unregister_chrdev(AOE_MAJOR, "aoechr");
@@ -319,4 +320,3 @@ aoechr_exit(void)
 	class_unregister(&aoe_class);
 	unregister_chrdev(AOE_MAJOR, "aoechr");
 }
-
-- 
2.34.1

[PATCH 2/6] bus: fsl-mc: initialize UAPI state before device registration

[Jiale Yao]

misc_register() exposes the fsl-mc UAPI device before its mutex and
static portal pointer are initialized. A userspace open racing device
creation can consequently lock an uninitialized mutex or observe
incomplete state.

Initialize the UAPI state before registering the misc device.

Fixes: 2cf1e703f066 ("bus: fsl-mc: add fsl-mc userspace support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/fsl-mc/fsl-mc-uapi.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c
index aaa14f17aef4..2c586dd787f3 100644
--- a/drivers/bus/fsl-mc/fsl-mc-uapi.c
+++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c
@@ -586,15 +586,13 @@ int fsl_mc_uapi_create_device_file(struct fsl_mc_bus *mc_bus)
 	mc_uapi->misc.minor = MISC_DYNAMIC_MINOR;
 	mc_uapi->misc.name = dev_name(&mc_dev->dev);
 	mc_uapi->misc.fops = &fsl_mc_uapi_dev_fops;
+	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
+	mutex_init(&mc_uapi->mutex);
 
 	error = misc_register(&mc_uapi->misc);
 	if (error)
 		return error;
 
-	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
-
-	mutex_init(&mc_uapi->mutex);
-
 	return 0;
 }
 
-- 
2.34.1

[PATCH 3/6] Drivers: hv: initialize partition table before device registration

[Jiale Yao]

misc_register() exposes /dev/mshv before the partition hash table and
its lock are initialized. A partition ioctl racing module initialization
can therefore access the table through an uninitialized spinlock.

Initialize the partition table and lock before registering the misc
device.

Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hv/mshv_root_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index cc2cfce2aefd..ce26320035b6 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -2369,6 +2369,9 @@ static int __init mshv_parent_partition_init(void)
 	if (hv_get_hypervisor_version(&version_info))
 		return -ENODEV;
 
+	spin_lock_init(&mshv_root.pt_ht_lock);
+	hash_init(mshv_root.pt_htable);
+
 	ret = misc_register(&mshv_dev);
 	if (ret)
 		return ret;
@@ -2407,9 +2410,6 @@ static int __init mshv_parent_partition_init(void)
 	if (ret)
 		goto exit_debugfs;
 
-	spin_lock_init(&mshv_root.pt_ht_lock);
-	hash_init(mshv_root.pt_htable);
-
 	hv_setup_mshv_handler(mshv_isr);
 
 	return 0;
-- 
2.34.1

[PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Jiale Yao]

misc_register() exposes the IBM VMC device before the HMC state and
spinlocks are initialized. A userspace operation racing module
initialization can therefore access an HMC through an uninitialized
spinlock.

Initialize all HMC state before registering the misc device.

Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/misc/ibmvmc.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index 6afef0788b90..d03aeb8dea8f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -2366,14 +2366,6 @@ static int __init ibmvmc_module_init(void)
 	ibmvmc.state = ibmvmc_state_initial;
 	pr_info("ibmvmc: version %s\n", IBMVMC_DRIVER_VERSION);
 
-	rc = misc_register(&ibmvmc_miscdev);
-	if (rc) {
-		pr_err("ibmvmc: misc registration failed\n");
-		goto misc_register_failed;
-	}
-	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
-		ibmvmc_miscdev.minor);
-
 	/* Initialize data structures */
 	memset(hmcs, 0, sizeof(struct ibmvmc_hmc) * MAX_HMCS);
 	for (i = 0; i < MAX_HMCS; i++) {
@@ -2383,6 +2375,14 @@ static int __init ibmvmc_module_init(void)
 			hmcs[i].queue_outbound_msgs[j] = VMC_INVALID_BUFFER_ID;
 	}
 
+	rc = misc_register(&ibmvmc_miscdev);
+	if (rc) {
+		pr_err("ibmvmc: misc registration failed\n");
+		goto misc_register_failed;
+	}
+	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
+		ibmvmc_miscdev.minor);
+
 	/* Sanity check module parms */
 	ibmvmc_scrub_module_parms();
 
-- 
2.34.1

[PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Jiale Yao]

device_create_file() makes the add and remove attributes writable before
the device list semaphore is initialized. A sysfs write racing module
initialization can therefore acquire an uninitialized rwsem.

Initialize the semaphore before registering the root device and its
attributes.

Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/s390/block/dcssblk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index e5a02c2990d0..46dd7eb9ca7d 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -1013,6 +1013,8 @@ dcssblk_init(void)
 {
 	int rc;
 
+	init_rwsem(&dcssblk_devices_sem);
+
 	dcssblk_root_dev = root_device_register("dcssblk");
 	if (IS_ERR(dcssblk_root_dev))
 		return PTR_ERR(dcssblk_root_dev);
@@ -1026,7 +1028,6 @@ dcssblk_init(void)
 	if (rc < 0)
 		goto out_root;
 	dcssblk_major = rc;
-	init_rwsem(&dcssblk_devices_sem);
 
 	dcssblk_check_params();
 	return 0;
-- 
2.34.1

[PATCH 6/6] watchdog: rdc321x: initialize device state before registration

[Jiale Yao]

misc_register() exposes the watchdog before its lock, completion, and
timer are initialized. A userspace operation racing probe can therefore
use any of these objects before it is ready.

Finish initializing the watchdog state before registering the misc
device.

Fixes: b3e8f2c13ae9 ("[WATCHDOG] Add support for the built-int RDC R-321x SoC watchdog")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/watchdog/rdc321x_wdt.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 8955177072fa..a2520d8d5c90 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -233,12 +233,6 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 	rdc321x_wdt_device.queue = 0;
 	rdc321x_wdt_device.default_ticks = ticks;
 
-	err = misc_register(&rdc321x_wdt_misc);
-	if (err < 0) {
-		dev_err(&pdev->dev, "misc_register failed\n");
-		return err;
-	}
-
 	spin_lock_init(&rdc321x_wdt_device.lock);
 
 	/* Reset the watchdog */
@@ -251,6 +245,12 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 
 	timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
 
+	err = misc_register(&rdc321x_wdt_misc);
+	if (err < 0) {
+		dev_err(&pdev->dev, "misc_register failed\n");
+		return err;
+	}
+
 	dev_info(&pdev->dev, "watchdog init success\n");
 
 	return 0;
-- 
2.34.1

Re: [PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Heiko Carstens]

On Wed, Oct 28, 2026 at 12:48:25PM +0800, Jiale Yao wrote:
> device_create_file() makes the add and remove attributes writable before
> the device list semaphore is initialized. A sysfs write racing module
> initialization can therefore acquire an uninitialized rwsem.
> 
> Initialize the semaphore before registering the root device and its
> attributes.
> 
> Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/s390/block/dcssblk.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index e5a02c2990d0..46dd7eb9ca7d 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -1013,6 +1013,8 @@ dcssblk_init(void)
>  {
>  	int rc;
>  
> +	init_rwsem(&dcssblk_devices_sem);
> +
>  	dcssblk_root_dev = root_device_register("dcssblk");
>  	if (IS_ERR(dcssblk_root_dev))
>  		return PTR_ERR(dcssblk_root_dev);
> @@ -1026,7 +1028,6 @@ dcssblk_init(void)
>  	if (rc < 0)
>  		goto out_root;
>  	dcssblk_major = rc;
> -	init_rwsem(&dcssblk_devices_sem);

I changed this to use a static DECLARE_RWSEM() declaration; and also
removed the incorrect Fixes tag - this is probably broken since the
driver exists.

Applied, thanks!

Re: [PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Arnd Bergmann]

On Wed, Oct 28, 2026, at 05:48, Jiale Yao wrote:
> misc_register() exposes the IBM VMC device before the HMC state and
> spinlocks are initialized. A userspace operation racing module
> initialization can therefore access an HMC through an uninitialized
> spinlock.
>
> Initialize all HMC state before registering the misc device.

It took me a bit to understand the exact race, as it's only
ibmvmc_setup_hmc() that has the race, not open(), but this looks
correct.

> Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

> +	rc = misc_register(&ibmvmc_miscdev);
> +	if (rc) {
> +		pr_err("ibmvmc: misc registration failed\n");
> +		goto misc_register_failed;
> +	}
> +	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> +		ibmvmc_miscdev.minor);
> +
>  	/* Sanity check module parms */
>  	ibmvmc_scrub_module_parms();

I would probably move it further down, either just before
the vio_register_driver(), or reordering the two and adding
the misc_device last, to make it really clear that it does
not depend on any of those.

      Arnd

Re: [PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Greg Kroah-Hartman]

On Wed, Oct 28, 2026 at 12:48:24PM +0800, Jiale Yao wrote:
> misc_register() exposes the IBM VMC device before the HMC state and
> spinlocks are initialized. A userspace operation racing module
> initialization can therefore access an HMC through an uninitialized
> spinlock.
> 
> Initialize all HMC state before registering the misc device.
> 
> Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/misc/ibmvmc.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
> index 6afef0788b90..d03aeb8dea8f 100644
> --- a/drivers/misc/ibmvmc.c
> +++ b/drivers/misc/ibmvmc.c
> @@ -2366,14 +2366,6 @@ static int __init ibmvmc_module_init(void)
>  	ibmvmc.state = ibmvmc_state_initial;
>  	pr_info("ibmvmc: version %s\n", IBMVMC_DRIVER_VERSION);
>  
> -	rc = misc_register(&ibmvmc_miscdev);
> -	if (rc) {
> -		pr_err("ibmvmc: misc registration failed\n");
> -		goto misc_register_failed;
> -	}
> -	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> -		ibmvmc_miscdev.minor);
> -
>  	/* Initialize data structures */
>  	memset(hmcs, 0, sizeof(struct ibmvmc_hmc) * MAX_HMCS);
>  	for (i = 0; i < MAX_HMCS; i++) {
> @@ -2383,6 +2375,14 @@ static int __init ibmvmc_module_init(void)
>  			hmcs[i].queue_outbound_msgs[j] = VMC_INVALID_BUFFER_ID;
>  	}
>  
> +	rc = misc_register(&ibmvmc_miscdev);
> +	if (rc) {
> +		pr_err("ibmvmc: misc registration failed\n");
> +		goto misc_register_failed;
> +	}
> +	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> +		ibmvmc_miscdev.minor);

Note, when drivers are successful, they are quiet, so this can go away
with an add-on patch.

thanks,

greg k-h