[PATCH v3 2/2] Drivers: hv: vmbus: Do not remove the channel when device registration fails

[Yuqiang Sun]

When vmbus_device_register() fails, it drops the device it was setting
up, and the device's release, vmbus_device_release(), calls
hv_process_channel_removal() on the channel. That function is for
channels the host has rescinded and starts with
BUG_ON(!channel->rescind), so the kernel stops there. Without the
BUG_ON, it would unmap and release the relid, unlink the channel and
free it, and then the error path of vmbus_add_channel_work() would do
all of that again.

When device_register() fails, clear the device's channel pointer before
dropping the device, and only remove the channel in
vmbus_device_release() if there is one: vmbus_add_channel_work() cleans
it up, after clearing the channel's pointer to the freed device. A
concurrent driver_attach() can still match the device while it is being
removed, so make vmbus_match() skip a device without a channel, and
look at the channel under rcu_read_lock(), as it is freed with
kfree_rcu().

The later failures, creating the channels directory or the primary
channel's kobject, come after device_register() may have bound a driver,
and a driver can hold on to the channel past its remove callback unless
the channel was rescinded (hv_sock's connection, or the sub-channels it
opened). So do not unregister the device for them: its channel is then
just missing from sysfs, as it is while the device is being set up. A
sub-channel of a device without a channels directory is left out of
sysfs too. This also applies to a sub-channel offered while its device
is still being registered, before the directory is created, which was
added to the top of /sys until now.

Fixes: c2e5df616e1a ("vmbus: add per-channel sysfs info")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Yuqiang Sun <izaiahsun@xxxxxxxxx>
---

Notes:
    The bug was found with kbound, a research static analysis prototype.
    The patch, the changelog and the test setup were written with the help
    of an AI coding assistant (Claude); I have reviewed them and tested them
    as described in the cover letter.
    
    Changes in v3: vmbus_match() reads the channel under rcu_read_lock(),
    the channel no longer points to the freed device, and a sub-channel of
    a device without a channels directory is left out of sysfs instead of
    being refused (Sashiko review of v2).
    
    Changes in v2: vmbus_match() skips a device without a channel, and the
    failures after device_register() keep the device instead of
    unregistering it (Sashiko review of v1).

 drivers/hv/channel_mgmt.c |  7 ++--
 drivers/hv/vmbus_drv.c    | 72 ++++++++++++++++++++++++---------------
 2 files changed, 49 insertions(+), 30 deletions(-)

diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index cb1d8d76928f..1fa232e86fce 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -554,15 +554,16 @@ static void vmbus_add_channel_work(struct work_struct *work)
 	 * method.
 	 *
 	 * If vmbus_device_register() fails, the 'device_obj' is freed in
-	 * vmbus_device_release() as called by device_unregister() in the
-	 * error path of vmbus_device_register(). In the outside error
-	 * path, there's no need to free it.
+	 * vmbus_device_release() as called by put_device() in the error
+	 * path of vmbus_device_register(). In the outside error path,
+	 * there's no need to free it, but the channel must not point to it.
 	 */
 	ret = vmbus_device_register(newchannel->device_obj);
 
 	if (ret != 0) {
 		pr_err("unable to add child device object (relid %d)\n",
 			newchannel->offermsg.child_relid);
+		newchannel->device_obj = NULL;
 		goto err_deq_chan;
 	}
 
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index fc0f16f51266..b41ce24e200c 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -840,9 +840,24 @@ static int vmbus_match(struct device *device, const struct device_driver *driver
 {
 	const struct hv_driver *drv = drv_to_hv_drv(driver);
 	struct hv_device *hv_dev = device_to_hv_device(device);
+	struct vmbus_channel *channel;
+	bool hvsock = false;
+
+	/*
+	 * No channel if vmbus_device_register() failed. The channel is then
+	 * freed after an RCU grace period.
+	 */
+	rcu_read_lock();
+	channel = READ_ONCE(hv_dev->channel);
+	if (channel)
+		hvsock = is_hvsock_channel(channel);
+	rcu_read_unlock();
+
+	if (!channel)
+		return 0;
 
 	/* The hv_sock driver handles all hv_sock offers. */
-	if (is_hvsock_channel(hv_dev->channel))
+	if (hvsock)
 		return drv->hvsock;
 
 	if (hv_vmbus_get_id(drv, hv_dev))
@@ -979,9 +994,15 @@ static void vmbus_device_release(struct device *device)
 
 	hv_debug_rm_dev_dir(hv_dev);
 
-	mutex_lock(&vmbus_connection.channel_mutex);
-	hv_process_channel_removal(channel);
-	mutex_unlock(&vmbus_connection.channel_mutex);
+	/*
+	 * No channel if vmbus_device_register() failed: the channel was not
+	 * rescinded, and vmbus_add_channel_work() cleans it up.
+	 */
+	if (channel) {
+		mutex_lock(&vmbus_connection.channel_mutex);
+		hv_process_channel_removal(channel);
+		mutex_unlock(&vmbus_connection.channel_mutex);
+	}
 	kfree(hv_dev);
 }
 
@@ -2099,15 +2120,24 @@ void vmbus_init_channel_kobj(struct vmbus_channel *channel)
 int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel)
 {
 	const struct device *device = &dev->device;
+	struct kset *kset = READ_ONCE(dev->channels_kset);
 	struct kobject *kobj = &channel->kobj;
 	u32 relid = channel->offermsg.child_relid;
 	int ret;
 
+	/*
+	 * The device has no channels directory if creating it failed, or not
+	 * yet while vmbus_device_register() is still running: leave the
+	 * channel out of sysfs.
+	 */
+	if (!kset)
+		return 0;
+
 	/*
 	 * On failure the kobject keeps its reference: the callers' error
 	 * paths drop it in free_channel(), which also frees the channel.
 	 */
-	kobj->kset = dev->channels_kset;
+	kobj->kset = kset;
 	ret = kobject_add(kobj, NULL, "%u", relid);
 	if (ret)
 		return ret;
@@ -2116,8 +2146,9 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel)
 
 	if (ret) {
 		/*
-		 * The calling functions' error handling paths will cleanup the
-		 * empty channel directory.
+		 * The empty channel directory goes away with the kobject: in
+		 * the error path of vmbus_add_channel_work() for a sub-channel,
+		 * and when its device is removed for a primary channel.
 		 */
 		dev_err(device, "Unable to set up channel sysfs files\n");
 		return ret;
@@ -2189,6 +2220,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	ret = device_register(&child_device_obj->device);
 	if (ret) {
 		pr_err("Unable to register child device\n");
+		WRITE_ONCE(child_device_obj->channel, NULL);
 		put_device(&child_device_obj->device);
 		return ret;
 	}
@@ -2205,31 +2237,17 @@ int vmbus_device_register(struct hv_device *child_device_obj)
 	 * here. The race can't result in a kernel failure, but the user space
 	 * program may get an error in accessing "channels" or its
 	 * subdirectories. See also comments with vmbus_add_dynid() about a
-	 * related race condition.
+	 * related race condition. For the same reason, the device stays
+	 * registered if its channel cannot be shown in sysfs.
 	 */
-	child_device_obj->channels_kset = kset_create_and_add("channels",
-							      NULL, kobj);
-	if (!child_device_obj->channels_kset) {
-		ret = -ENOMEM;
-		goto err_dev_unregister;
-	}
-
-	ret = vmbus_add_channel_kobj(child_device_obj,
-				     child_device_obj->channel);
-	if (ret) {
+	WRITE_ONCE(child_device_obj->channels_kset,
+		   kset_create_and_add("channels", NULL, kobj));
+	if (!child_device_obj->channels_kset ||
+	    vmbus_add_channel_kobj(child_device_obj, child_device_obj->channel))
 		pr_err("Unable to register primary channel\n");
-		goto err_kset_unregister;
-	}
 	hv_debug_add_dev_dir(child_device_obj);
 
 	return 0;
-
-err_kset_unregister:
-	kset_unregister(child_device_obj->channels_kset);
-
-err_dev_unregister:
-	device_unregister(&child_device_obj->device);
-	return ret;
 }
 
 /*
-- 
2.53.0