[PATCH] block/rnbd: Fix double free in process_msg_open

[PATCH] block/rnbd: Fix double free in process_msg_open

[Guangshuo Li]

process_msg_open() allocates srv_sess_dev with
rnbd_srv_create_set_sess_dev() and then initializes its embedded kobject
through rnbd_srv_create_dev_session_sysfs().

If sysfs creation fails, the helper calls kobject_put(). The final put
invokes rnbd_srv_sess_dev_release(), which reaches
rnbd_destroy_sess_dev() and frees srv_sess_dev. process_msg_open() then
jumps to free_srv_sess_dev and calls kfree() on the same object again,
resulting in a double free.

Add the session device to the list and release srv_dev->lock before
creating the sysfs entries. On failure, rely on the kobject release
callback as the sole owner of the cleanup instead of freeing the object
again.

This issue was found by a static analysis tool I am developing.

Fixes: 8cee532f469b ("block/rnbd: server: sysfs interface functions")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/block/rnbd/rnbd-srv.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
index 10e8c438bb43..5a991bfbf3ad 100644
--- a/drivers/block/rnbd/rnbd-srv.c
+++ b/drivers/block/rnbd/rnbd-srv.c
@@ -778,18 +778,22 @@ static int process_msg_open(struct rnbd_srv_session *srv_sess,
 		}
 	}
 
+	/*
+	 * Add the session device to the list before initializing its
+	 * kobject. If sysfs creation fails, kobject_put() invokes the
+	 * release callback, which removes the object from this list and
+	 * releases all resources associated with the session device.
+	 */
+	list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
+	mutex_unlock(&srv_dev->lock);
+
 	ret = rnbd_srv_create_dev_session_sysfs(srv_sess_dev);
 	if (ret) {
-		mutex_unlock(&srv_dev->lock);
-		rnbd_srv_err(srv_sess_dev,
-			      "Opening device failed, failed to create dev client sysfs files, err: %d\n",
-			      ret);
-		goto free_srv_sess_dev;
+		pr_err("Opening device '%s' on session %s failed, failed to create dev client sysfs files, err: %d\n",
+		       full_path, srv_sess->sessname, ret);
+		goto free_path;
 	}
 
-	list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
-	mutex_unlock(&srv_dev->lock);
-
 	rnbd_srv_info(srv_sess_dev, "Opened device '%s'\n", srv_dev->name);
 
 	kfree(full_path);
-- 
2.43.0

Re: [PATCH] block/rnbd: Fix double free in process_msg_open

[Jinpu Wang]

On Tue, Jul 14, 2026 at 1:53 PM Guangshuo Li <lgs201920130244@gmail.com> wrote:
>
> process_msg_open() allocates srv_sess_dev with
> rnbd_srv_create_set_sess_dev() and then initializes its embedded kobject
> through rnbd_srv_create_dev_session_sysfs().
>
> If sysfs creation fails, the helper calls kobject_put(). The final put
> invokes rnbd_srv_sess_dev_release(), which reaches
> rnbd_destroy_sess_dev() and frees srv_sess_dev. process_msg_open() then
> jumps to free_srv_sess_dev and calls kfree() on the same object again,
> resulting in a double free.
>
> Add the session device to the list and release srv_dev->lock before
> creating the sysfs entries. On failure, rely on the kobject release
> callback as the sole owner of the cleanup instead of freeing the object
> again.
>
> This issue was found by a static analysis tool I am developing.
>
> Fixes: 8cee532f469b ("block/rnbd: server: sysfs interface functions")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
lgtm.
Acked-by: Jack Wang <jinpu.wang@cloud.ionos.com>
> ---
>  drivers/block/rnbd/rnbd-srv.c | 20 ++++++++++++--------
>  1 file changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
> index 10e8c438bb43..5a991bfbf3ad 100644
> --- a/drivers/block/rnbd/rnbd-srv.c
> +++ b/drivers/block/rnbd/rnbd-srv.c
> @@ -778,18 +778,22 @@ static int process_msg_open(struct rnbd_srv_session *srv_sess,
>                 }
>         }
>
> +       /*
> +        * Add the session device to the list before initializing its
> +        * kobject. If sysfs creation fails, kobject_put() invokes the
> +        * release callback, which removes the object from this list and
> +        * releases all resources associated with the session device.
> +        */
> +       list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
> +       mutex_unlock(&srv_dev->lock);
> +
>         ret = rnbd_srv_create_dev_session_sysfs(srv_sess_dev);
>         if (ret) {
> -               mutex_unlock(&srv_dev->lock);
> -               rnbd_srv_err(srv_sess_dev,
> -                             "Opening device failed, failed to create dev client sysfs files, err: %d\n",
> -                             ret);
> -               goto free_srv_sess_dev;
> +               pr_err("Opening device '%s' on session %s failed, failed to create dev client sysfs files, err: %d\n",
> +                      full_path, srv_sess->sessname, ret);
> +               goto free_path;
>         }
>
> -       list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list);
> -       mutex_unlock(&srv_dev->lock);
> -
>         rnbd_srv_info(srv_sess_dev, "Opened device '%s'\n", srv_dev->name);
>
>         kfree(full_path);
> --
> 2.43.0
>