[PATCH] Drivers: hv: util: Fix transport teardown on util_probe() failure

[PATCH] Drivers: hv: util: Fix transport teardown on util_probe() failure

[Andrey Misiurov]

Commit 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer
not initialized yet") moved the creation of the KVP and VSS transports
after vmbus_open(). util_probe() still calls srv->util_deinit() when
vmbus_open() or util_init_transport() fails, and hv_kvp_deinit() and
hv_vss_deinit() destroy hvt unconditionally.

On the first probe, or when hvutil_transport_init() has failed, hvt is
NULL and hvutil_transport_destroy() dereferences it.  After an unbind,
hvt still points to the transport freed by util_remove(), so a failed
re-probe frees it a second time.

Skip the destroy when there is no transport and clear hvt after it.

Found while reviewing a backport of commit 07a756a49f4b.
Not reproduced at runtime.

Fixes: 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Misiurov <amisiurov@cloudlinux.com>
---
 drivers/hv/hv_kvp.c      | 5 ++++-
 drivers/hv/hv_snapshot.c | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 336b278..813bec5 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -825,5 +825,8 @@ void hv_kvp_deinit(void)
 
 	hv_kvp_cancel_work();
 
-	hvutil_transport_destroy(hvt);
+	if (hvt) {
+		hvutil_transport_destroy(hvt);
+		hvt = NULL;
+	}
 }
diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index 847dc69..a827cef 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -456,5 +456,8 @@ void hv_vss_deinit(void)
 
 	hv_vss_cancel_work();
 
-	hvutil_transport_destroy(hvt);
+	if (hvt) {
+		hvutil_transport_destroy(hvt);
+		hvt = NULL;
+	}
 }
-- 
2.43.7

Re: [PATCH] Drivers: hv: util: Fix transport teardown on util_probe() failure

[Naman Jain]

On 11/5/2026 2:00 AM, Andrey Misiurov wrote:
> Commit 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer
> not initialized yet") moved the creation of the KVP and VSS transports
> after vmbus_open(). util_probe() still calls srv->util_deinit() when
> vmbus_open() or util_init_transport() fails, and hv_kvp_deinit() and
> hv_vss_deinit() destroy hvt unconditionally.
> 
> On the first probe, or when hvutil_transport_init() has failed, hvt is
> NULL and hvutil_transport_destroy() dereferences it.  After an unbind,
> hvt still points to the transport freed by util_remove(), so a failed
> re-probe frees it a second time.
> 
> Skip the destroy when there is no transport and clear hvt after it.
> 
> Found while reviewing a backport of commit 07a756a49f4b.
> Not reproduced at runtime.
> 

Ideally above 2 lines should go as comments in this patch here [1]. 
Keeping that nit aside, this LGTM.

Reviewed-by: Naman Jain <namjain@linux.microsoft.com>


> Fixes: 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet")
> Cc: stable@vger.kernel.org
> Signed-off-by: Andrey Misiurov <amisiurov@cloudlinux.com>
> ---

[1].

>   drivers/hv/hv_kvp.c      | 5 ++++-
>   drivers/hv/hv_snapshot.c | 5 ++++-
>   2 files changed, 8 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
> index 336b278..813bec5 100644
> --- a/drivers/hv/hv_kvp.c
> +++ b/drivers/hv/hv_kvp.c
> @@ -825,5 +825,8 @@ void hv_kvp_deinit(void)
>   
>   	hv_kvp_cancel_work();
>   
> -	hvutil_transport_destroy(hvt);
> +	if (hvt) {
> +		hvutil_transport_destroy(hvt);
> +		hvt = NULL;
> +	}
>   }
> diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
> index 847dc69..a827cef 100644
> --- a/drivers/hv/hv_snapshot.c
> +++ b/drivers/hv/hv_snapshot.c
> @@ -456,5 +456,8 @@ void hv_vss_deinit(void)
>   
>   	hv_vss_cancel_work();
>   
> -	hvutil_transport_destroy(hvt);
> +	if (hvt) {
> +		hvutil_transport_destroy(hvt);
> +		hvt = NULL;
> +	}
>   }

Regards,
Naman