[PATCH 0/6] Initialize device state before userspace registration

[PATCH 0/6] Initialize device state before userspace registration

[Jiale Yao]

Several drivers register character devices or sysfs attributes before
initializing synchronization objects and related state used by their
userspace entry points. Registration makes those entry points immediately
available, so a concurrent access can reach partially initialized state.

Move each initialization ahead of the corresponding registration. The
patches are independent and cover AoE, fsl-mc, MSHV, IBM VMC, DCSSBLK,
and the RDC321x watchdog.

Jiale Yao (6):
  aoe: initialize error message synchronization before registration
  bus: fsl-mc: initialize UAPI state before device registration
  Drivers: hv: initialize partition table before device registration
  misc: ibmvmc: initialize HMC state before device registration
  s390/dcssblk: initialize device semaphore before sysfs registration
  watchdog: rdc321x: initialize device state before registration

 drivers/block/aoe/aoechr.c       |  6 +++---
 drivers/bus/fsl-mc/fsl-mc-uapi.c |  6 ++----
 drivers/hv/mshv_root_main.c      |  6 +++---
 drivers/misc/ibmvmc.c            | 16 ++++++++--------
 drivers/s390/block/dcssblk.c     |  3 ++-
 drivers/watchdog/rdc321x_wdt.c   | 12 ++++++------
 6 files changed, 24 insertions(+), 25 deletions(-)

-- 
2.34.1

[PATCH 1/6] aoe: initialize error message synchronization before registration

[Jiale Yao]

register_chrdev() makes the AoE character device available before the
error message completion and lock are initialized. A userspace access
racing module initialization can therefore use either object before it
is ready.

Initialize both synchronization objects before registering the character
device.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/block/aoe/aoechr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/aoe/aoechr.c b/drivers/block/aoe/aoechr.c
index a42c4bcc85ba..efc09c97ff23 100644
--- a/drivers/block/aoe/aoechr.c
+++ b/drivers/block/aoe/aoechr.c
@@ -288,13 +288,14 @@ aoechr_init(void)
 {
 	int n, i;
 
+	init_completion(&emsgs_comp);
+	spin_lock_init(&emsgs_lock);
+
 	n = register_chrdev(AOE_MAJOR, "aoechr", &aoe_fops);
 	if (n < 0) {
 		printk(KERN_ERR "aoe: can't register char device\n");
 		return n;
 	}
-	init_completion(&emsgs_comp);
-	spin_lock_init(&emsgs_lock);
 	n = class_register(&aoe_class);
 	if (n) {
 		unregister_chrdev(AOE_MAJOR, "aoechr");
@@ -319,4 +320,3 @@ aoechr_exit(void)
 	class_unregister(&aoe_class);
 	unregister_chrdev(AOE_MAJOR, "aoechr");
 }
-
-- 
2.34.1

[PATCH 2/6] bus: fsl-mc: initialize UAPI state before device registration

[Jiale Yao]

misc_register() exposes the fsl-mc UAPI device before its mutex and
static portal pointer are initialized. A userspace open racing device
creation can consequently lock an uninitialized mutex or observe
incomplete state.

Initialize the UAPI state before registering the misc device.

Fixes: 2cf1e703f066 ("bus: fsl-mc: add fsl-mc userspace support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/fsl-mc/fsl-mc-uapi.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c
index aaa14f17aef4..2c586dd787f3 100644
--- a/drivers/bus/fsl-mc/fsl-mc-uapi.c
+++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c
@@ -586,15 +586,13 @@ int fsl_mc_uapi_create_device_file(struct fsl_mc_bus *mc_bus)
 	mc_uapi->misc.minor = MISC_DYNAMIC_MINOR;
 	mc_uapi->misc.name = dev_name(&mc_dev->dev);
 	mc_uapi->misc.fops = &fsl_mc_uapi_dev_fops;
+	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
+	mutex_init(&mc_uapi->mutex);
 
 	error = misc_register(&mc_uapi->misc);
 	if (error)
 		return error;
 
-	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
-
-	mutex_init(&mc_uapi->mutex);
-
 	return 0;
 }
 
-- 
2.34.1

[PATCH 3/6] Drivers: hv: initialize partition table before device registration

[Jiale Yao]

misc_register() exposes /dev/mshv before the partition hash table and
its lock are initialized. A partition ioctl racing module initialization
can therefore access the table through an uninitialized spinlock.

Initialize the partition table and lock before registering the misc
device.

Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hv/mshv_root_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index cc2cfce2aefd..ce26320035b6 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -2369,6 +2369,9 @@ static int __init mshv_parent_partition_init(void)
 	if (hv_get_hypervisor_version(&version_info))
 		return -ENODEV;
 
+	spin_lock_init(&mshv_root.pt_ht_lock);
+	hash_init(mshv_root.pt_htable);
+
 	ret = misc_register(&mshv_dev);
 	if (ret)
 		return ret;
@@ -2407,9 +2410,6 @@ static int __init mshv_parent_partition_init(void)
 	if (ret)
 		goto exit_debugfs;
 
-	spin_lock_init(&mshv_root.pt_ht_lock);
-	hash_init(mshv_root.pt_htable);
-
 	hv_setup_mshv_handler(mshv_isr);
 
 	return 0;
-- 
2.34.1

[PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Jiale Yao]

device_create_file() makes the add and remove attributes writable before
the device list semaphore is initialized. A sysfs write racing module
initialization can therefore acquire an uninitialized rwsem.

Initialize the semaphore before registering the root device and its
attributes.

Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/s390/block/dcssblk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index e5a02c2990d0..46dd7eb9ca7d 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -1013,6 +1013,8 @@ dcssblk_init(void)
 {
 	int rc;
 
+	init_rwsem(&dcssblk_devices_sem);
+
 	dcssblk_root_dev = root_device_register("dcssblk");
 	if (IS_ERR(dcssblk_root_dev))
 		return PTR_ERR(dcssblk_root_dev);
@@ -1026,7 +1028,6 @@ dcssblk_init(void)
 	if (rc < 0)
 		goto out_root;
 	dcssblk_major = rc;
-	init_rwsem(&dcssblk_devices_sem);
 
 	dcssblk_check_params();
 	return 0;
-- 
2.34.1

[PATCH 6/6] watchdog: rdc321x: initialize device state before registration

[Jiale Yao]

misc_register() exposes the watchdog before its lock, completion, and
timer are initialized. A userspace operation racing probe can therefore
use any of these objects before it is ready.

Finish initializing the watchdog state before registering the misc
device.

Fixes: b3e8f2c13ae9 ("[WATCHDOG] Add support for the built-int RDC R-321x SoC watchdog")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/watchdog/rdc321x_wdt.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 8955177072fa..a2520d8d5c90 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -233,12 +233,6 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 	rdc321x_wdt_device.queue = 0;
 	rdc321x_wdt_device.default_ticks = ticks;
 
-	err = misc_register(&rdc321x_wdt_misc);
-	if (err < 0) {
-		dev_err(&pdev->dev, "misc_register failed\n");
-		return err;
-	}
-
 	spin_lock_init(&rdc321x_wdt_device.lock);
 
 	/* Reset the watchdog */
@@ -251,6 +245,12 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 
 	timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
 
+	err = misc_register(&rdc321x_wdt_misc);
+	if (err < 0) {
+		dev_err(&pdev->dev, "misc_register failed\n");
+		return err;
+	}
+
 	dev_info(&pdev->dev, "watchdog init success\n");
 
 	return 0;
-- 
2.34.1

Re: [PATCH 3/6] Drivers: hv: initialize partition table before device registration

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] hv: mshv: premature misc_register() in mshv_parent_partition_init()
--

commit c189d106f4a7c8456e535fcfffc6e71d86c62b6d
Author: Jiale Yao <yaojiale02@163.com>

Drivers: hv: initialize partition table before device registration

This commit moves the initialization of mshv_root.pt_ht_lock and
mshv_root.pt_htable ahead of misc_register(&mshv_dev) in
mshv_parent_partition_init() so that concurrent partition ioctls do not
access an uninitialized spinlock or hash table.

> diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
> index cc2cfce2aefdb..ce26320035b6f 100644
> --- a/drivers/hv/mshv_root_main.c
> +++ b/drivers/hv/mshv_root_main.c
> @@ -2369,6 +2369,9 @@ static int __init mshv_parent_partition_init(void)
>  	if (hv_get_hypervisor_version(&version_info))
>  		return -ENODEV;
>  
> +	spin_lock_init(&mshv_root.pt_ht_lock);
> +	hash_init(mshv_root.pt_htable);
> +
>  	ret = misc_register(&mshv_dev);
>  	if (ret)
>  		return ret;
> @@ -2407,9 +2410,6 @@ static int __init mshv_parent_partition_init(void)
>  	if (ret)
>  		goto exit_debugfs;
>  
> -	spin_lock_init(&mshv_root.pt_ht_lock);
> -	hash_init(mshv_root.pt_htable);
> -
>  	hv_setup_mshv_handler(mshv_isr);
>  
>  	return 0;

[Severity: High]
Does moving only pt_ht_lock and pt_htable initialization ahead of
misc_register(&mshv_dev) leave /dev/mshv exposed while the rest of the
subsystem is still uninitialized?

In drivers/hv/mshv_root_main.c:mshv_parent_partition_init(),
misc_register(&mshv_dev) is still called before mshv_synic_init(),
mshv_init_vmm_caps(), mshv_retrieve_scheduler_type(), root_scheduler_init(),
mshv_debugfs_init(), mshv_irqfd_wq_init(), and hv_setup_mshv_handler().

If userspace opens /dev/mshv and issues MSHV_CREATE_PARTITION via
mshv_dev_ioctl() -> mshv_ioctl_create_partition() during this window,
partition creation now succeeds, which can trigger several issues before
mshv_parent_partition_init() finishes:

1. If the partition fd is closed before mshv_irqfd_wq_init() runs,
mshv_partition_release() -> mshv_eventfd_release() -> mshv_irqfd_release() in
drivers/hv/mshv_eventfd.c calls:

	flush_workqueue(irqfd_cleanup_wq);

while irqfd_cleanup_wq is still NULL.

2. If MSHV_INITIALIZE_PARTITION or MSHV_CREATE_VP runs before
mshv_debugfs_init() sets mshv_debugfs, mshv_debugfs_partition_create() and
mshv_debugfs_vp_create() return early and leave partition->pt_stats_dentry
and vp->vp_stats_dentry as NULL. When the partition is later destroyed after
mshv_debugfs_init() completes, destroy_partition() calls
mshv_debugfs_partition_remove() in drivers/hv/mshv_debugfs.c:

	if (!mshv_debugfs)
		return;

	partition_debugfs_remove(partition->pt_id,
				 partition->pt_stats_dentry);

which dereferences the NULL dentry pointer.

3. If MSHV_RUN_VP runs after mshv_retrieve_scheduler_type() sets
hv_scheduler_type to HV_SCHEDULER_TYPE_ROOT, but before root_scheduler_init()
allocates the per-CPU buffers, mshv_vp_dispatch() in
drivers/hv/mshv_root_main.c dereferences NULL per-CPU pointers:

	preempt_disable();
	input = *this_cpu_ptr(root_scheduler_input);
	output = *this_cpu_ptr(root_scheduler_output);

	memset(input, 0, sizeof(*input));

4. In mshv_ioctl_create_partition(), the partition file descriptor is created
with anon_inode_getfile("mshv_partition", &mshv_partition_fops, partition,
O_RDWR), which does not take a module reference. If a subsequent init step in
mshv_parent_partition_init() fails and triggers misc_deregister(&mshv_dev),
module initialization fails while the hypervisor partition remains allocated
and userspace retains an open file descriptor referencing unloaded module
fops.

Could misc_register(&mshv_dev) instead be moved to the end of
mshv_parent_partition_init() (or after all subsystem state is initialized,
passing NULL or a dedicated device pointer to the early init helpers)?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028044828.96177-2-yaojiale02@163.com?part=3

Re: [PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[sashiko-bot]

> device_create_file() makes the add and remove attributes writable before
> the device list semaphore is initialized. A sysfs write racing module
> initialization can therefore acquire an uninitialized rwsem.
> 
> Initialize the semaphore before registering the root device and its
> attributes.
> 
> Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261028044828.96177-2-yaojiale02@163.com?part=5

Re: [PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Heiko Carstens]

On Wed, Oct 28, 2026 at 12:48:25PM +0800, Jiale Yao wrote:
> device_create_file() makes the add and remove attributes writable before
> the device list semaphore is initialized. A sysfs write racing module
> initialization can therefore acquire an uninitialized rwsem.
> 
> Initialize the semaphore before registering the root device and its
> attributes.
> 
> Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/s390/block/dcssblk.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index e5a02c2990d0..46dd7eb9ca7d 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -1013,6 +1013,8 @@ dcssblk_init(void)
>  {
>  	int rc;
>  
> +	init_rwsem(&dcssblk_devices_sem);
> +
>  	dcssblk_root_dev = root_device_register("dcssblk");
>  	if (IS_ERR(dcssblk_root_dev))
>  		return PTR_ERR(dcssblk_root_dev);
> @@ -1026,7 +1028,6 @@ dcssblk_init(void)
>  	if (rc < 0)
>  		goto out_root;
>  	dcssblk_major = rc;
> -	init_rwsem(&dcssblk_devices_sem);

I changed this to use a static DECLARE_RWSEM() declaration; and also
removed the incorrect Fixes tag - this is probably broken since the
driver exists.

Applied, thanks!

Re: [PATCH 6/6] watchdog: rdc321x: initialize device state before registration

[Guenter Roeck]

On 10/27/26 21:48, Jiale Yao wrote:
> misc_register() exposes the watchdog before its lock, completion, and
> timer are initialized. A userspace operation racing probe can therefore
> use any of these objects before it is ready.
> 
> Finish initializing the watchdog state before registering the misc
> device.
> 
> Fixes: b3e8f2c13ae9 ("[WATCHDOG] Add support for the built-int RDC R-321x SoC watchdog")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

I am not going to apply this (or similar) patches.
If you do have hardware utilizing this watchdog, pleae convert the driver
to use the watchdog subsystem. Otherwise, please leave it alone.

Thanks,
Guenter

> ---
>   drivers/watchdog/rdc321x_wdt.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
> index 8955177072fa..a2520d8d5c90 100644
> --- a/drivers/watchdog/rdc321x_wdt.c
> +++ b/drivers/watchdog/rdc321x_wdt.c
> @@ -233,12 +233,6 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
>   	rdc321x_wdt_device.queue = 0;
>   	rdc321x_wdt_device.default_ticks = ticks;
>   
> -	err = misc_register(&rdc321x_wdt_misc);
> -	if (err < 0) {
> -		dev_err(&pdev->dev, "misc_register failed\n");
> -		return err;
> -	}
> -
>   	spin_lock_init(&rdc321x_wdt_device.lock);
>   
>   	/* Reset the watchdog */
> @@ -251,6 +245,12 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
>   
>   	timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
>   
> +	err = misc_register(&rdc321x_wdt_misc);
> +	if (err < 0) {
> +		dev_err(&pdev->dev, "misc_register failed\n");
> +		return err;
> +	}
> +
>   	dev_info(&pdev->dev, "watchdog init success\n");
>   
>   	return 0;