linux-kernel - Re: [PATCH] block: fix kobject double initialization in add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6b63027c-cdbb-5878-28ea-ef58de37fe03@huaweicloud.com>
Date: Thu, 7 Aug 2025 16:42:02 +0800
From: Yu Kuai <yukuai1@...weicloud.com>
To: Zheng Qixing <zhengqixing@...weicloud.com>, axboe@...nel.dk
Cc: linux-block@...r.kernel.org, linux-kernel@...r.kernel.org,
 yi.zhang@...wei.com, yangerkun@...wei.com, houtao1@...wei.com,
 zhengqixing@...wei.com, "yukuai (C)" <yukuai3@...wei.com>
Subject: Re: [PATCH] block: fix kobject double initialization in add_disk

在 2025/08/07 15:20, Zheng Qixing 写道:
> From: Zheng Qixing<zhengqixing@...wei.com>
> 
> Device-mapper can call add_disk() multiple times for the same gendisk
> due to its two-phase creation process (dm create + dm load). This leads
> to kobject double initialization errors when the underlying iSCSI devices
> become temporarily unavailable and then reappear.
> 
> However, if the first add_disk() call fails and is retried, the queue_kobj
> gets initialized twice, causing:
> 
> kobject: kobject (ffff88810c27bb90): tried to init an initialized object,
> something is seriously wrong.
>   Call Trace:
>    <TASK>
>    dump_stack_lvl+0x5b/0x80
>    kobject_init.cold+0x43/0x51
>    blk_register_queue+0x46/0x280
>    add_disk_fwnode+0xb5/0x280
>    dm_setup_md_queue+0x194/0x1c0
>    table_load+0x297/0x2d0
>    ctl_ioctl+0x2a2/0x480
>    dm_ctl_ioctl+0xe/0x20
>    __x64_sys_ioctl+0xc7/0x110
>    do_syscall_64+0x72/0x390
>    entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Fix this by separating kobject initialization from sysfs registration:
>   - Initialize queue_kobj early during gendisk allocation
>   - add_disk() only adds the already-initialized kobject to sysfs
>   - del_gendisk() removes from sysfs but doesn't destroy the kobject
>   - Final cleanup happens when the disk is released
> 
> Fixes: 2bd85221a625 ("block: untangle request_queue refcounting from sysfs")
> Reported-by: Li Lingfeng<lilingfeng3@...wei.com>
> Closes:https://lore.kernel.org/all/83591d0b-2467-433c-bce0-5581298eb161@huawei.com/
> Signed-off-by: Zheng Qixing<zhengqixing@...wei.com>
> ---
>   block/blk-sysfs.c | 4 +---
>   block/blk.h       | 1 +
>   block/genhd.c     | 2 ++
>   3 files changed, 4 insertions(+), 3 deletions(-)

LGTM, the kobject_init() is called when queue is allocated before the
fix tag.

Reviewed-by: Yu Kuai <yukuai3@...wei.com>