process_msg_open() allocates srv_sess_dev with rnbd_srv_create_set_sess_dev() and then initializes its embedded kobject through rnbd_srv_create_dev_session_sysfs(). If sysfs creation fails, the helper calls kobject_put(). The final put invokes rnbd_srv_sess_dev_release(), which reaches rnbd_destroy_sess_dev() and frees srv_sess_dev. process_msg_open() then jumps to free_srv_sess_dev and calls kfree() on the same object again, resulting in a double free. Add the session device to the list and release srv_dev->lock before creating the sysfs entries. On failure, rely on the kobject release callback as the sole owner of the cleanup instead of freeing the object again. This issue was found by a static analysis tool I am developing. Fixes: 8cee532f469b ("block/rnbd: server: sysfs interface functions") Signed-off-by: Guangshuo Li --- drivers/block/rnbd/rnbd-srv.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c index 10e8c438bb43..5a991bfbf3ad 100644 --- a/drivers/block/rnbd/rnbd-srv.c +++ b/drivers/block/rnbd/rnbd-srv.c @@ -778,18 +778,22 @@ static int process_msg_open(struct rnbd_srv_session *srv_sess, } } + /* + * Add the session device to the list before initializing its + * kobject. If sysfs creation fails, kobject_put() invokes the + * release callback, which removes the object from this list and + * releases all resources associated with the session device. + */ + list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list); + mutex_unlock(&srv_dev->lock); + ret = rnbd_srv_create_dev_session_sysfs(srv_sess_dev); if (ret) { - mutex_unlock(&srv_dev->lock); - rnbd_srv_err(srv_sess_dev, - "Opening device failed, failed to create dev client sysfs files, err: %d\n", - ret); - goto free_srv_sess_dev; + pr_err("Opening device '%s' on session %s failed, failed to create dev client sysfs files, err: %d\n", + full_path, srv_sess->sessname, ret); + goto free_path; } - list_add(&srv_sess_dev->dev_list, &srv_dev->sess_dev_list); - mutex_unlock(&srv_dev->lock); - rnbd_srv_info(srv_sess_dev, "Opened device '%s'\n", srv_dev->name); kfree(full_path); -- 2.43.0