Skip to content

rnbd-clt: fix refcount underflow in device unmap path#478

Closed
blktests-ci[bot] wants to merge 2 commits intolinus-master_basefrom
series/1041453=>linus-master
Closed

rnbd-clt: fix refcount underflow in device unmap path#478
blktests-ci[bot] wants to merge 2 commits intolinus-master_basefrom
series/1041453=>linus-master

Conversation

@blktests-ci
Copy link

@blktests-ci blktests-ci bot commented Jan 12, 2026

Pull request for series with
subject: rnbd-clt: fix refcount underflow in device unmap path
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1041453

@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 12, 2026

Upstream branch: 623fb99
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from f962a4d to 06634b5 Compare January 13, 2026 21:24
@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 13, 2026

Upstream branch: b543459
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 3194b22 to 99bd498 Compare January 13, 2026 21:28
@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 14, 2026

Upstream branch: b543459
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 99bd498 to f42d945 Compare January 14, 2026 08:49
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 06634b5 to 8a473ad Compare January 15, 2026 08:55
@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 15, 2026

Upstream branch: 944aacb
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from f42d945 to 026b448 Compare January 15, 2026 08:59
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 8a473ad to fa94b37 Compare January 19, 2026 00:27
@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 19, 2026

Upstream branch: 944aacb
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 026b448 to 1444927 Compare January 19, 2026 00:31
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch 2 times, most recently from 41a5848 to 30680e5 Compare January 22, 2026 10:04
@blktests-ci
Copy link
Author

blktests-ci bot commented Jan 22, 2026

Upstream branch: a66191c
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

Pull request is NOT updated. Failed to apply https://patchwork.kernel.org/project/linux-block/list/?series=1041453
error message:

Cmd('git') failed due to: exit code(128)
  cmdline: git am --3way
  stdout: 'Applying: rnbd-clt: fix refcount underflow in device unmap path
Patch failed at 0001 rnbd-clt: fix refcount underflow in device unmap path'
  stderr: 'error: sha1 information is lacking or useless (drivers/block/rnbd/rnbd-clt.c).
error: could not build fake ancestor
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"'

conflict:

@blktests-ci blktests-ci bot force-pushed the linus-master_base branch 4 times, most recently from b44af19 to 483aa43 Compare January 29, 2026 00:24
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 483aa43 to 9d3c6de Compare February 3, 2026 19:06
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 3, 2026

Upstream branch: de0674d
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 1444927 to 5ca6b4e Compare February 3, 2026 19:19
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 9d3c6de to 7c2ae0a Compare February 5, 2026 03:28
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 5, 2026

Upstream branch: f14faaf
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 5ca6b4e to f3f05e7 Compare February 5, 2026 03:41
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 7c2ae0a to 54294d6 Compare February 6, 2026 08:51
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 6, 2026

Upstream branch: b7ff715
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from f3f05e7 to cbae1f8 Compare February 6, 2026 09:04
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 54294d6 to eb49f7b Compare February 8, 2026 02:55
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 8, 2026

Upstream branch: e7aa572
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from cbae1f8 to 2ad69c0 Compare February 8, 2026 04:26
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from eb49f7b to 30e5c22 Compare February 9, 2026 04:29
@ChaitanayaKulkarni @kawasaki
rnbd-clt: fix refcount underflow in device unmap path
6fab997 
During device unmapping (triggered by module unload or explicit unmap),
a refcount underflow occurs causing a use-after-free warning:

  [14747.574913] ------------[ cut here ]------------
  [14747.574916] refcount_t: underflow; use-after-free.
  [14747.574917] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x55/0x90, CPU#9: kworker/9:1/378
  [14747.574924] Modules linked in: rnbd_client(-) rtrs_client rnbd_server rtrs_server rtrs_core ...
  [14747.574998] CPU: 9 UID: 0 PID: 378 Comm: kworker/9:1 Tainted: G           O     N  6.19.0-rc3lblk-fnext+ #42 PREEMPT(voluntary)
  [14747.575005] Workqueue: rnbd_clt_wq unmap_device_work [rnbd_client]
  [14747.575010] RIP: 0010:refcount_warn_saturate+0x55/0x90
  [14747.575037]  Call Trace:
  [14747.575038]   <TASK>
  [14747.575038]   rnbd_clt_unmap_device+0x170/0x1d0 [rnbd_client]
  [14747.575044]   process_one_work+0x211/0x600
  [14747.575052]   worker_thread+0x184/0x330
  [14747.575055]   ? __pfx_worker_thread+0x10/0x10
  [14747.575058]   kthread+0x10d/0x250
  [14747.575062]   ? __pfx_kthread+0x10/0x10
  [14747.575066]   ret_from_fork+0x319/0x390
  [14747.575069]   ? __pfx_kthread+0x10/0x10
  [14747.575072]   ret_from_fork_asm+0x1a/0x30
  [14747.575083]   </TASK>
  [14747.575096] ---[ end trace 0000000000000000 ]---

Befor this patch :-

The bug is a double kobject_put() on dev->kobj during device cleanup.

Kobject Lifecycle:
  kobject_init_and_add()  sets kobj.kref = 1  (initialization)
  kobject_put()           sets kobj.kref = 0  (should be called once)

* Before this patch:

rnbd_clt_unmap_device()
  rnbd_destroy_sysfs()
    kobject_del(&dev->kobj)                   [remove from sysfs]
    kobject_put(&dev->kobj)                   PUT #1 (WRONG!)
      kref: 1 to 0
      rnbd_dev_release()
        kfree(dev)                            [DEVICE FREED!]

  rnbd_destroy_gen_disk()                     [use-after-free!]

  rnbd_clt_put_dev()
    refcount_dec_and_test(&dev->refcount)
    kobject_put(&dev->kobj)                   PUT #2 (UNDERFLOW!)
      kref: 0 to -1                           [WARNING!]

The first kobject_put() in rnbd_destroy_sysfs() prematurely frees the
device via rnbd_dev_release(), then the second kobject_put() in
rnbd_clt_put_dev() causes refcount underflow.

* After this patch :-

Remove kobject_put() from rnbd_destroy_sysfs(). This function should
only remove sysfs visibility (kobject_del), not manage object lifetime.

Call Graph (FIXED):

rnbd_clt_unmap_device()
  rnbd_destroy_sysfs()
    kobject_del(&dev->kobj)                   [remove from sysfs only]
                                              [kref unchanged: 1]

  rnbd_destroy_gen_disk()                     [device still valid]

  rnbd_clt_put_dev()
    refcount_dec_and_test(&dev->refcount)
    kobject_put(&dev->kobj)                   ONLY PUT (CORRECT!)
      kref: 1 to 0                            [BALANCED]
      rnbd_dev_release()
        kfree(dev)                            [CLEAN DESTRUCTION]

This follows the kernel pattern where sysfs removal (kobject_del) is
separate from object destruction (kobject_put).

Fixes: 581cf83 ("block: rnbd: add .release to rnbd_dev_ktype")
Signed-off-by: Chaitanya Kulkarni <[email protected]>
Acked-by: Jack Wang <[email protected]>
Reviewed-by: Jack Wang <[email protected]>
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 9, 2026

Upstream branch: 05f7e89
series: https://patchwork.kernel.org/project/linux-block/list/?series=1041453
version: 1

@blktests-ci blktests-ci bot force-pushed the series/1041453=>linus-master branch from 2ad69c0 to 6fab997 Compare February 9, 2026 04:41
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 30e5c22 to 519f160 Compare February 12, 2026 00:34
@blktests-ci
Copy link
Author

blktests-ci bot commented Feb 12, 2026

At least one diff in series https://patchwork.kernel.org/project/linux-block/list/?series=1041453 irrelevant now for [{'archived': False, 'project': 241}] search patterns

@blktests-ci blktests-ci bot closed this Feb 12, 2026
@blktests-ci blktests-ci bot deleted the series/1041453=>linus-master branch February 13, 2026 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

linus-master new V1-ci-fail V1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kawasaki @ChaitanayaKulkarni