[PATCH 2/2] Drivers: hv: vmbus: Do not remove the channel when device registration fails

[Yuqiang Sun]

When vmbus_device_register() fails, it drops the device it was setting
up, and the device's release, vmbus_device_release(), calls
hv_process_channel_removal() on the channel. That function is for
channels the host has rescinded and starts with
BUG_ON(!channel->rescind), so the kernel stops there. Without the
BUG_ON, it would unmap and release the relid, unlink the channel and
free it, and then the error path of vmbus_add_channel_work() would do
all of that again.

Leave the channel to vmbus_add_channel_work(): clear the device's
channel pointer before dropping the device on the error paths of
vmbus_device_register(), and only remove the channel in
vmbus_device_release() if there is one. If a driver was bound, its
remove callback runs in device_del() and still sees the channel.

Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuqiang Sun <izaiahsun@xxxxxxxxx>
---

Notes:
    The bug was found with kbound, a research static analysis prototype.
    The patch, the changelog and the test setup were written with the help
    of an AI coding assistant (Claude); I have reviewed them and tested them
    as described in the cover letter.

 drivers/hv/vmbus_drv.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index fc0f16f51266..e8fb0c4c4f5e 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -979,9 +979,15 @@ static void vmbus_device_release(struct device *device)
 
 	hv_debug_rm_dev_dir(hv_dev);
 
-	mutex_lock(&vmbus_connection.channel_mutex);
-	hv_process_channel_removal(channel);
-	mutex_unlock(&vmbus_connection.channel_mutex);
+	/*
+	 * No channel if vmbus_device_register() failed: the channel was not
+	 * rescinded, and vmbus_add_channel_work() cleans it up.
+	 */
+	if (channel) {
+		mutex_lock(&vmbus_connection.channel_mutex);
+		hv_process_channel_removal(channel);
+		mutex_unlock(&vmbus_connection.channel_mutex);
+	}
 	kfree(hv_dev);
 }
 
@@ -2189,6 +2195,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	ret = device_register(&child_device_obj->device);
 	if (ret) {
 		pr_err("Unable to register child device\n");
+		child_device_obj->channel = NULL;
 		put_device(&child_device_obj->device);
 		return ret;
 	}
@@ -2228,7 +2235,10 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	kset_unregister(child_device_obj->channels_kset);
 
 err_dev_unregister:
-	device_unregister(&child_device_obj->device);
+	/* The driver's remove, if one was bound, still needs the channel */
+	device_del(&child_device_obj->device);
+	child_device_obj->channel = NULL;
+	put_device(&child_device_obj->device);
 	return ret;
 }
 
-- 
2.53.0