[PATCH 1/6] aoe: initialize error message synchronization before registration

[PATCH 1/6] aoe: initialize error message synchronization before registration

[Jiale Yao]

register_chrdev() makes the AoE character device available before the
error message completion and lock are initialized. A userspace access
racing module initialization can therefore use either object before it
is ready.

Initialize both synchronization objects before registering the character
device.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/block/aoe/aoechr.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/block/aoe/aoechr.c b/drivers/block/aoe/aoechr.c
index a42c4bcc85ba..efc09c97ff23 100644
--- a/drivers/block/aoe/aoechr.c
+++ b/drivers/block/aoe/aoechr.c
@@ -288,13 +288,14 @@ aoechr_init(void)
 {
 	int n, i;
 
+	init_completion(&emsgs_comp);
+	spin_lock_init(&emsgs_lock);
+
 	n = register_chrdev(AOE_MAJOR, "aoechr", &aoe_fops);
 	if (n < 0) {
 		printk(KERN_ERR "aoe: can't register char device\n");
 		return n;
 	}
-	init_completion(&emsgs_comp);
-	spin_lock_init(&emsgs_lock);
 	n = class_register(&aoe_class);
 	if (n) {
 		unregister_chrdev(AOE_MAJOR, "aoechr");
@@ -319,4 +320,3 @@ aoechr_exit(void)
 	class_unregister(&aoe_class);
 	unregister_chrdev(AOE_MAJOR, "aoechr");
 }
-
-- 
2.34.1

[PATCH 2/6] bus: fsl-mc: initialize UAPI state before device registration

[Jiale Yao]

misc_register() exposes the fsl-mc UAPI device before its mutex and
static portal pointer are initialized. A userspace open racing device
creation can consequently lock an uninitialized mutex or observe
incomplete state.

Initialize the UAPI state before registering the misc device.

Fixes: 2cf1e703f066 ("bus: fsl-mc: add fsl-mc userspace support")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/bus/fsl-mc/fsl-mc-uapi.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c
index aaa14f17aef4..2c586dd787f3 100644
--- a/drivers/bus/fsl-mc/fsl-mc-uapi.c
+++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c
@@ -586,15 +586,13 @@ int fsl_mc_uapi_create_device_file(struct fsl_mc_bus *mc_bus)
 	mc_uapi->misc.minor = MISC_DYNAMIC_MINOR;
 	mc_uapi->misc.name = dev_name(&mc_dev->dev);
 	mc_uapi->misc.fops = &fsl_mc_uapi_dev_fops;
+	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
+	mutex_init(&mc_uapi->mutex);
 
 	error = misc_register(&mc_uapi->misc);
 	if (error)
 		return error;
 
-	mc_uapi->static_mc_io = mc_bus->mc_dev.mc_io;
-
-	mutex_init(&mc_uapi->mutex);
-
 	return 0;
 }
 
-- 
2.34.1

[PATCH 3/6] Drivers: hv: initialize partition table before device registration

[Jiale Yao]

misc_register() exposes /dev/mshv before the partition hash table and
its lock are initialized. A partition ioctl racing module initialization
can therefore access the table through an uninitialized spinlock.

Initialize the partition table and lock before registering the misc
device.

Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hv/mshv_root_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
index cc2cfce2aefd..ce26320035b6 100644
--- a/drivers/hv/mshv_root_main.c
+++ b/drivers/hv/mshv_root_main.c
@@ -2369,6 +2369,9 @@ static int __init mshv_parent_partition_init(void)
 	if (hv_get_hypervisor_version(&version_info))
 		return -ENODEV;
 
+	spin_lock_init(&mshv_root.pt_ht_lock);
+	hash_init(mshv_root.pt_htable);
+
 	ret = misc_register(&mshv_dev);
 	if (ret)
 		return ret;
@@ -2407,9 +2410,6 @@ static int __init mshv_parent_partition_init(void)
 	if (ret)
 		goto exit_debugfs;
 
-	spin_lock_init(&mshv_root.pt_ht_lock);
-	hash_init(mshv_root.pt_htable);
-
 	hv_setup_mshv_handler(mshv_isr);
 
 	return 0;
-- 
2.34.1

Re: [PATCH 3/6] Drivers: hv: initialize partition table before device registration

[Wei Liu]

On Wed, Oct 28, 2026 at 12:48:23PM +0800, Jiale Yao wrote:
> misc_register() exposes /dev/mshv before the partition hash table and
> its lock are initialized. A partition ioctl racing module initialization
> can therefore access the table through an uninitialized spinlock.
> 
> Initialize the partition table and lock before registering the misc
> device.
> 
> Fixes: 621191d709b1 ("Drivers: hv: Introduce mshv_root module to expose /dev/mshv to VMMs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

If such races are really a problem, shouldn't the msic_register call be
the last in the function?

Wei

> ---
>  drivers/hv/mshv_root_main.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/hv/mshv_root_main.c b/drivers/hv/mshv_root_main.c
> index cc2cfce2aefd..ce26320035b6 100644
> --- a/drivers/hv/mshv_root_main.c
> +++ b/drivers/hv/mshv_root_main.c
> @@ -2369,6 +2369,9 @@ static int __init mshv_parent_partition_init(void)
>  	if (hv_get_hypervisor_version(&version_info))
>  		return -ENODEV;
>  
> +	spin_lock_init(&mshv_root.pt_ht_lock);
> +	hash_init(mshv_root.pt_htable);
> +
>  	ret = misc_register(&mshv_dev);
>  	if (ret)
>  		return ret;
> @@ -2407,9 +2410,6 @@ static int __init mshv_parent_partition_init(void)
>  	if (ret)
>  		goto exit_debugfs;
>  
> -	spin_lock_init(&mshv_root.pt_ht_lock);
> -	hash_init(mshv_root.pt_htable);
> -
>  	hv_setup_mshv_handler(mshv_isr);
>  
>  	return 0;
> -- 
> 2.34.1
> 

[PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Jiale Yao]

misc_register() exposes the IBM VMC device before the HMC state and
spinlocks are initialized. A userspace operation racing module
initialization can therefore access an HMC through an uninitialized
spinlock.

Initialize all HMC state before registering the misc device.

Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/misc/ibmvmc.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
index 6afef0788b90..d03aeb8dea8f 100644
--- a/drivers/misc/ibmvmc.c
+++ b/drivers/misc/ibmvmc.c
@@ -2366,14 +2366,6 @@ static int __init ibmvmc_module_init(void)
 	ibmvmc.state = ibmvmc_state_initial;
 	pr_info("ibmvmc: version %s\n", IBMVMC_DRIVER_VERSION);
 
-	rc = misc_register(&ibmvmc_miscdev);
-	if (rc) {
-		pr_err("ibmvmc: misc registration failed\n");
-		goto misc_register_failed;
-	}
-	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
-		ibmvmc_miscdev.minor);
-
 	/* Initialize data structures */
 	memset(hmcs, 0, sizeof(struct ibmvmc_hmc) * MAX_HMCS);
 	for (i = 0; i < MAX_HMCS; i++) {
@@ -2383,6 +2375,14 @@ static int __init ibmvmc_module_init(void)
 			hmcs[i].queue_outbound_msgs[j] = VMC_INVALID_BUFFER_ID;
 	}
 
+	rc = misc_register(&ibmvmc_miscdev);
+	if (rc) {
+		pr_err("ibmvmc: misc registration failed\n");
+		goto misc_register_failed;
+	}
+	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
+		ibmvmc_miscdev.minor);
+
 	/* Sanity check module parms */
 	ibmvmc_scrub_module_parms();
 
-- 
2.34.1

Re: [PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Arnd Bergmann]

On Wed, Oct 28, 2026, at 05:48, Jiale Yao wrote:
> misc_register() exposes the IBM VMC device before the HMC state and
> spinlocks are initialized. A userspace operation racing module
> initialization can therefore access an HMC through an uninitialized
> spinlock.
>
> Initialize all HMC state before registering the misc device.

It took me a bit to understand the exact race, as it's only
ibmvmc_setup_hmc() that has the race, not open(), but this looks
correct.

> Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

> +	rc = misc_register(&ibmvmc_miscdev);
> +	if (rc) {
> +		pr_err("ibmvmc: misc registration failed\n");
> +		goto misc_register_failed;
> +	}
> +	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> +		ibmvmc_miscdev.minor);
> +
>  	/* Sanity check module parms */
>  	ibmvmc_scrub_module_parms();

I would probably move it further down, either just before
the vio_register_driver(), or reordering the two and adding
the misc_device last, to make it really clear that it does
not depend on any of those.

      Arnd

Re: [PATCH 4/6] misc: ibmvmc: initialize HMC state before device registration

[Greg Kroah-Hartman]

On Wed, Oct 28, 2026 at 12:48:24PM +0800, Jiale Yao wrote:
> misc_register() exposes the IBM VMC device before the HMC state and
> spinlocks are initialized. A userspace operation racing module
> initialization can therefore access an HMC through an uninitialized
> spinlock.
> 
> Initialize all HMC state before registering the misc device.
> 
> Fixes: 0eca353e7ae7 ("misc: IBM Virtual Management Channel Driver (VMC)")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/misc/ibmvmc.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/misc/ibmvmc.c b/drivers/misc/ibmvmc.c
> index 6afef0788b90..d03aeb8dea8f 100644
> --- a/drivers/misc/ibmvmc.c
> +++ b/drivers/misc/ibmvmc.c
> @@ -2366,14 +2366,6 @@ static int __init ibmvmc_module_init(void)
>  	ibmvmc.state = ibmvmc_state_initial;
>  	pr_info("ibmvmc: version %s\n", IBMVMC_DRIVER_VERSION);
>  
> -	rc = misc_register(&ibmvmc_miscdev);
> -	if (rc) {
> -		pr_err("ibmvmc: misc registration failed\n");
> -		goto misc_register_failed;
> -	}
> -	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> -		ibmvmc_miscdev.minor);
> -
>  	/* Initialize data structures */
>  	memset(hmcs, 0, sizeof(struct ibmvmc_hmc) * MAX_HMCS);
>  	for (i = 0; i < MAX_HMCS; i++) {
> @@ -2383,6 +2375,14 @@ static int __init ibmvmc_module_init(void)
>  			hmcs[i].queue_outbound_msgs[j] = VMC_INVALID_BUFFER_ID;
>  	}
>  
> +	rc = misc_register(&ibmvmc_miscdev);
> +	if (rc) {
> +		pr_err("ibmvmc: misc registration failed\n");
> +		goto misc_register_failed;
> +	}
> +	pr_info("ibmvmc: node %d:%d\n", MISC_MAJOR,
> +		ibmvmc_miscdev.minor);

Note, when drivers are successful, they are quiet, so this can go away
with an add-on patch.

thanks,

greg k-h

[PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Jiale Yao]

device_create_file() makes the add and remove attributes writable before
the device list semaphore is initialized. A sysfs write racing module
initialization can therefore acquire an uninitialized rwsem.

Initialize the semaphore before registering the root device and its
attributes.

Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/s390/block/dcssblk.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
index e5a02c2990d0..46dd7eb9ca7d 100644
--- a/drivers/s390/block/dcssblk.c
+++ b/drivers/s390/block/dcssblk.c
@@ -1013,6 +1013,8 @@ dcssblk_init(void)
 {
 	int rc;
 
+	init_rwsem(&dcssblk_devices_sem);
+
 	dcssblk_root_dev = root_device_register("dcssblk");
 	if (IS_ERR(dcssblk_root_dev))
 		return PTR_ERR(dcssblk_root_dev);
@@ -1026,7 +1028,6 @@ dcssblk_init(void)
 	if (rc < 0)
 		goto out_root;
 	dcssblk_major = rc;
-	init_rwsem(&dcssblk_devices_sem);
 
 	dcssblk_check_params();
 	return 0;
-- 
2.34.1

Re: [PATCH 5/6] s390/dcssblk: initialize device semaphore before sysfs registration

[Heiko Carstens]

On Wed, Oct 28, 2026 at 12:48:25PM +0800, Jiale Yao wrote:
> device_create_file() makes the add and remove attributes writable before
> the device list semaphore is initialized. A sysfs write racing module
> initialization can therefore acquire an uninitialized rwsem.
> 
> Initialize the semaphore before registering the root device and its
> attributes.
> 
> Fixes: c369527f18f8 ("[S390] pm: dcssblk power management callbacks.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  drivers/s390/block/dcssblk.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c
> index e5a02c2990d0..46dd7eb9ca7d 100644
> --- a/drivers/s390/block/dcssblk.c
> +++ b/drivers/s390/block/dcssblk.c
> @@ -1013,6 +1013,8 @@ dcssblk_init(void)
>  {
>  	int rc;
>  
> +	init_rwsem(&dcssblk_devices_sem);
> +
>  	dcssblk_root_dev = root_device_register("dcssblk");
>  	if (IS_ERR(dcssblk_root_dev))
>  		return PTR_ERR(dcssblk_root_dev);
> @@ -1026,7 +1028,6 @@ dcssblk_init(void)
>  	if (rc < 0)
>  		goto out_root;
>  	dcssblk_major = rc;
> -	init_rwsem(&dcssblk_devices_sem);

I changed this to use a static DECLARE_RWSEM() declaration; and also
removed the incorrect Fixes tag - this is probably broken since the
driver exists.

Applied, thanks!

[PATCH 6/6] watchdog: rdc321x: initialize device state before registration

[Jiale Yao]

misc_register() exposes the watchdog before its lock, completion, and
timer are initialized. A userspace operation racing probe can therefore
use any of these objects before it is ready.

Finish initializing the watchdog state before registering the misc
device.

Fixes: b3e8f2c13ae9 ("[WATCHDOG] Add support for the built-int RDC R-321x SoC watchdog")
Cc: stable@vger.kernel.org
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/watchdog/rdc321x_wdt.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 8955177072fa..a2520d8d5c90 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -233,12 +233,6 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 	rdc321x_wdt_device.queue = 0;
 	rdc321x_wdt_device.default_ticks = ticks;
 
-	err = misc_register(&rdc321x_wdt_misc);
-	if (err < 0) {
-		dev_err(&pdev->dev, "misc_register failed\n");
-		return err;
-	}
-
 	spin_lock_init(&rdc321x_wdt_device.lock);
 
 	/* Reset the watchdog */
@@ -251,6 +245,12 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 
 	timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
 
+	err = misc_register(&rdc321x_wdt_misc);
+	if (err < 0) {
+		dev_err(&pdev->dev, "misc_register failed\n");
+		return err;
+	}
+
 	dev_info(&pdev->dev, "watchdog init success\n");
 
 	return 0;
-- 
2.34.1

Re: [PATCH 6/6] watchdog: rdc321x: initialize device state before registration

[Guenter Roeck]

On 10/27/26 21:48, Jiale Yao wrote:
> misc_register() exposes the watchdog before its lock, completion, and
> timer are initialized. A userspace operation racing probe can therefore
> use any of these objects before it is ready.
> 
> Finish initializing the watchdog state before registering the misc
> device.
> 
> Fixes: b3e8f2c13ae9 ("[WATCHDOG] Add support for the built-int RDC R-321x SoC watchdog")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>

I am not going to apply this (or similar) patches.
If you do have hardware utilizing this watchdog, pleae convert the driver
to use the watchdog subsystem. Otherwise, please leave it alone.

Thanks,
Guenter

> ---
>   drivers/watchdog/rdc321x_wdt.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
> index 8955177072fa..a2520d8d5c90 100644
> --- a/drivers/watchdog/rdc321x_wdt.c
> +++ b/drivers/watchdog/rdc321x_wdt.c
> @@ -233,12 +233,6 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
>   	rdc321x_wdt_device.queue = 0;
>   	rdc321x_wdt_device.default_ticks = ticks;
>   
> -	err = misc_register(&rdc321x_wdt_misc);
> -	if (err < 0) {
> -		dev_err(&pdev->dev, "misc_register failed\n");
> -		return err;
> -	}
> -
>   	spin_lock_init(&rdc321x_wdt_device.lock);
>   
>   	/* Reset the watchdog */
> @@ -251,6 +245,12 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
>   
>   	timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
>   
> +	err = misc_register(&rdc321x_wdt_misc);
> +	if (err < 0) {
> +		dev_err(&pdev->dev, "misc_register failed\n");
> +		return err;
> +	}
> +
>   	dev_info(&pdev->dev, "watchdog init success\n");
>   
>   	return 0;