drivers/amba/bus.c | 37 +++------------ drivers/base/driver.c | 75 ------------------------------ drivers/bus/fsl-mc/fsl-mc-bus.c | 43 +++-------------- drivers/cdx/cdx.c | 40 ++-------------- drivers/hv/vmbus_drv.c | 36 ++------------ drivers/pci/pci-driver.c | 11 +++-- drivers/pci/pci-sysfs.c | 28 ----------- drivers/pci/probe.c | 1 - drivers/platform/wmi/core.c | 36 ++------------ drivers/rpmsg/qcom_glink_native.c | 2 - drivers/rpmsg/rpmsg_core.c | 43 +++-------------- drivers/rpmsg/virtio_rpmsg_bus.c | 1 - drivers/s390/cio/cio.h | 5 -- drivers/s390/cio/css.c | 34 ++------------ drivers/s390/crypto/ap_bus.c | 34 +++++++------- drivers/s390/crypto/ap_bus.h | 1 - drivers/s390/crypto/ap_queue.c | 24 +++------- drivers/spi/spi.c | 19 +++----- drivers/vdpa/vdpa.c | 48 ++----------------- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +- drivers/vfio/pci/vfio_pci_core.c | 5 +- drivers/xen/xen-pciback/pci_stub.c | 6 ++- include/linux/amba/bus.h | 5 -- include/linux/cdx/cdx_bus.h | 4 -- include/linux/device/driver.h | 2 - include/linux/fsl/mc.h | 4 -- include/linux/hyperv.h | 5 -- include/linux/pci.h | 6 --- include/linux/rpmsg.h | 4 -- include/linux/spi/spi.h | 5 -- include/linux/vdpa.h | 4 -- include/linux/wmi.h | 4 -- 32 files changed, 88 insertions(+), 488 deletions(-)
This is the follow-up of the driver_override generalization in [1], converting the remaining 11 busses and removing the now-unused driver_set_override() helper. All of them (except AP, which has a different race condition) are prone to the potential UAF described in [2], caused by accessing the driver_override field from their corresponding match() callback. In order to address this, the generalized driver_override field in struct device is protected with a spinlock. The driver-core provides accessors, such as device_match_driver_override(), device_has_driver_override() and device_set_driver_override(), which all ensure proper locking internally. Additionally, the driver-core provides a driver_override flag in struct bus_type, which, once enabled, automatically registers generic sysfs callbacks, allowing userspace to modify the driver_override field. SPI and AP are a bit special; both print "\n" when driver_override is not set, whereas all other buses (and thus the driver-core) produce "(null)\n" in this case. Hence, SPI and AP do not take advantage of the driver_override flag in struct bus_type; AP additionally maintains a counter in its custom sysfs store(). Technically, we could support a custom fallback string when driver_override is unset in struct bus_type, but only SPI would benefit from this, since AP has additional custom logic in store() anyways. (I'm not sure if there are userspace programs that strictly rely on this; driverctl seems to check for both, but I rather not break some userspace tool I'm not aware of. :) This series is based on v7.0-rc5 with no additional dependencies, hence those patches can be picked up by subsystems individually. [1] https://lore.kernel.org/driver-core/20260303115720.48783-1-dakr@kernel.org/ [2] https://bugzilla.kernel.org/show_bug.cgi?id=220789 [3] https://gitlab.com/driverctl/driverctl/-/blob/0.121/driverctl?ref_type=tags#L99 Danilo Krummrich (12): amba: use generic driver_override infrastructure bus: fsl-mc: use generic driver_override infrastructure cdx: use generic driver_override infrastructure hv: vmbus: use generic driver_override infrastructure PCI: use generic driver_override infrastructure platform/wmi: use generic driver_override infrastructure rpmsg: use generic driver_override infrastructure vdpa: use generic driver_override infrastructure s390/cio: use generic driver_override infrastructure s390/ap: use generic driver_override infrastructure spi: use generic driver_override infrastructure driver core: remove driver_set_override() drivers/amba/bus.c | 37 +++------------ drivers/base/driver.c | 75 ------------------------------ drivers/bus/fsl-mc/fsl-mc-bus.c | 43 +++-------------- drivers/cdx/cdx.c | 40 ++-------------- drivers/hv/vmbus_drv.c | 36 ++------------ drivers/pci/pci-driver.c | 11 +++-- drivers/pci/pci-sysfs.c | 28 ----------- drivers/pci/probe.c | 1 - drivers/platform/wmi/core.c | 36 ++------------ drivers/rpmsg/qcom_glink_native.c | 2 - drivers/rpmsg/rpmsg_core.c | 43 +++-------------- drivers/rpmsg/virtio_rpmsg_bus.c | 1 - drivers/s390/cio/cio.h | 5 -- drivers/s390/cio/css.c | 34 ++------------ drivers/s390/crypto/ap_bus.c | 34 +++++++------- drivers/s390/crypto/ap_bus.h | 1 - drivers/s390/crypto/ap_queue.c | 24 +++------- drivers/spi/spi.c | 19 +++----- drivers/vdpa/vdpa.c | 48 ++----------------- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +- drivers/vfio/pci/vfio_pci_core.c | 5 +- drivers/xen/xen-pciback/pci_stub.c | 6 ++- include/linux/amba/bus.h | 5 -- include/linux/cdx/cdx_bus.h | 4 -- include/linux/device/driver.h | 2 - include/linux/fsl/mc.h | 4 -- include/linux/hyperv.h | 5 -- include/linux/pci.h | 6 --- include/linux/rpmsg.h | 4 -- include/linux/spi/spi.h | 5 -- include/linux/vdpa.h | 4 -- include/linux/wmi.h | 4 -- 32 files changed, 88 insertions(+), 488 deletions(-) base-commit: c369299895a591d96745d6492d4888259b004a9e -- 2.53.0
On Tue, Mar 24, 2026 at 01:59:04AM +0100, Danilo Krummrich wrote: > This is the follow-up of the driver_override generalization in [1], converting > the remaining 11 busses and removing the now-unused driver_set_override() > helper. > > All of them (except AP, which has a different race condition) are prone to the > potential UAF described in [2], caused by accessing the driver_override field > from their corresponding match() callback. > > In order to address this, the generalized driver_override field in struct device > is protected with a spinlock. The driver-core provides accessors, such as > device_match_driver_override(), device_has_driver_override() and > device_set_driver_override(), which all ensure proper locking internally. > > Additionally, the driver-core provides a driver_override flag in struct > bus_type, which, once enabled, automatically registers generic sysfs callbacks, > allowing userspace to modify the driver_override field. > > SPI and AP are a bit special; both print "\n" when driver_override is not set, > whereas all other buses (and thus the driver-core) produce "(null)\n" in this > case. > > Hence, SPI and AP do not take advantage of the driver_override flag in struct > bus_type; AP additionally maintains a counter in its custom sysfs store(). > > Technically, we could support a custom fallback string when driver_override is > unset in struct bus_type, but only SPI would benefit from this, since AP has > additional custom logic in store() anyways. > > (I'm not sure if there are userspace programs that strictly rely on this; > driverctl seems to check for both, but I rather not break some userspace tool > I'm not aware of. :) > > This series is based on v7.0-rc5 with no additional dependencies, hence those > patches can be picked up by subsystems individually. > > [1] https://lore.kernel.org/driver-core/20260303115720.48783-1-dakr@kernel.org/ > [2] https://bugzilla.kernel.org/show_bug.cgi?id=220789 > [3] https://gitlab.com/driverctl/driverctl/-/blob/0.121/driverctl?ref_type=tags#L99 vdpa bits: Acked-by: Michael S. Tsirkin <mst@redhat.com> I assume it'll all be merged together? > Danilo Krummrich (12): > amba: use generic driver_override infrastructure > bus: fsl-mc: use generic driver_override infrastructure > cdx: use generic driver_override infrastructure > hv: vmbus: use generic driver_override infrastructure > PCI: use generic driver_override infrastructure > platform/wmi: use generic driver_override infrastructure > rpmsg: use generic driver_override infrastructure > vdpa: use generic driver_override infrastructure > s390/cio: use generic driver_override infrastructure > s390/ap: use generic driver_override infrastructure > spi: use generic driver_override infrastructure > driver core: remove driver_set_override() > > drivers/amba/bus.c | 37 +++------------ > drivers/base/driver.c | 75 ------------------------------ > drivers/bus/fsl-mc/fsl-mc-bus.c | 43 +++-------------- > drivers/cdx/cdx.c | 40 ++-------------- > drivers/hv/vmbus_drv.c | 36 ++------------ > drivers/pci/pci-driver.c | 11 +++-- > drivers/pci/pci-sysfs.c | 28 ----------- > drivers/pci/probe.c | 1 - > drivers/platform/wmi/core.c | 36 ++------------ > drivers/rpmsg/qcom_glink_native.c | 2 - > drivers/rpmsg/rpmsg_core.c | 43 +++-------------- > drivers/rpmsg/virtio_rpmsg_bus.c | 1 - > drivers/s390/cio/cio.h | 5 -- > drivers/s390/cio/css.c | 34 ++------------ > drivers/s390/crypto/ap_bus.c | 34 +++++++------- > drivers/s390/crypto/ap_bus.h | 1 - > drivers/s390/crypto/ap_queue.c | 24 +++------- > drivers/spi/spi.c | 19 +++----- > drivers/vdpa/vdpa.c | 48 ++----------------- > drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +- > drivers/vfio/pci/vfio_pci_core.c | 5 +- > drivers/xen/xen-pciback/pci_stub.c | 6 ++- > include/linux/amba/bus.h | 5 -- > include/linux/cdx/cdx_bus.h | 4 -- > include/linux/device/driver.h | 2 - > include/linux/fsl/mc.h | 4 -- > include/linux/hyperv.h | 5 -- > include/linux/pci.h | 6 --- > include/linux/rpmsg.h | 4 -- > include/linux/spi/spi.h | 5 -- > include/linux/vdpa.h | 4 -- > include/linux/wmi.h | 4 -- > 32 files changed, 88 insertions(+), 488 deletions(-) > > > base-commit: c369299895a591d96745d6492d4888259b004a9e > -- > 2.53.0
On Wed Mar 25, 2026 at 10:29 AM CET, Michael S. Tsirkin wrote: > vdpa bits: > > Acked-by: Michael S. Tsirkin <mst@redhat.com> > > I assume it'll all be merged together? I can take it through the driver-core tree if you prefer, but you can also pick it up yourself.
On Tue Mar 24, 2026 at 1:59 AM CET, Danilo Krummrich wrote: > Danilo Krummrich (12): > PCI: use generic driver_override infrastructure > platform/wmi: use generic driver_override infrastructure > vdpa: use generic driver_override infrastructure > s390/cio: use generic driver_override infrastructure > s390/ap: use generic driver_override infrastructure Applied to driver-core-testing, thanks! > amba: use generic driver_override infrastructure > cdx: use generic driver_override infrastructure > hv: vmbus: use generic driver_override infrastructure > rpmsg: use generic driver_override infrastructure I have not picked these up, as they have not received ACKs from the corresponding subsystem maintainers so far. > bus: fsl-mc: use generic driver_override infrastructure > spi: use generic driver_override infrastructure These have already been picked up via the respective subsystem trees -- thanks! Thanks, Danilo
Le 04/04/2026 à 17:07, Danilo Krummrich a écrit : > On Tue Mar 24, 2026 at 1:59 AM CET, Danilo Krummrich wrote: >> Danilo Krummrich (12): >> PCI: use generic driver_override infrastructure >> platform/wmi: use generic driver_override infrastructure >> vdpa: use generic driver_override infrastructure >> s390/cio: use generic driver_override infrastructure >> s390/ap: use generic driver_override infrastructure > > Applied to driver-core-testing, thanks! > >> amba: use generic driver_override infrastructure >> cdx: use generic driver_override infrastructure >> hv: vmbus: use generic driver_override infrastructure >> rpmsg: use generic driver_override infrastructure > > I have not picked these up, as they have not received ACKs from the > corresponding subsystem maintainers so far. > >> bus: fsl-mc: use generic driver_override infrastructure I droped it from soc_fsl tree, some dependency must be missing. Feal free to take it if you can, it is acked-by Ioana. >> spi: use generic driver_override infrastructure > > These have already been picked up via the respective subsystem trees -- thanks! > > Thanks, > Danilo
On Sat Apr 4, 2026 at 6:58 PM CEST, Christophe Leroy (CS GROUP) wrote: > > > Le 04/04/2026 à 17:07, Danilo Krummrich a écrit : >> On Tue Mar 24, 2026 at 1:59 AM CET, Danilo Krummrich wrote: >>> Danilo Krummrich (12): >>> PCI: use generic driver_override infrastructure >>> platform/wmi: use generic driver_override infrastructure >>> vdpa: use generic driver_override infrastructure >>> s390/cio: use generic driver_override infrastructure >>> s390/ap: use generic driver_override infrastructure >> >> Applied to driver-core-testing, thanks! >> >>> amba: use generic driver_override infrastructure >>> cdx: use generic driver_override infrastructure >>> hv: vmbus: use generic driver_override infrastructure >>> rpmsg: use generic driver_override infrastructure >> >> I have not picked these up, as they have not received ACKs from the >> corresponding subsystem maintainers so far. >> >>> bus: fsl-mc: use generic driver_override infrastructure > > I droped it from soc_fsl tree, some dependency must be missing. > > Feal free to take it if you can, it is acked-by Ioana. It is based on v7.0-rc5; if you want I can pick it up. >>> spi: use generic driver_override infrastructure >> >> These have already been picked up via the respective subsystem trees -- thanks! >> >> Thanks, >> Danilo
Le 04/04/2026 à 19:04, Danilo Krummrich a écrit : > On Sat Apr 4, 2026 at 6:58 PM CEST, Christophe Leroy (CS GROUP) wrote: >> >> >> Le 04/04/2026 à 17:07, Danilo Krummrich a écrit : >>> On Tue Mar 24, 2026 at 1:59 AM CET, Danilo Krummrich wrote: >>>> Danilo Krummrich (12): >>>> PCI: use generic driver_override infrastructure >>>> platform/wmi: use generic driver_override infrastructure >>>> vdpa: use generic driver_override infrastructure >>>> s390/cio: use generic driver_override infrastructure >>>> s390/ap: use generic driver_override infrastructure >>> >>> Applied to driver-core-testing, thanks! >>> >>>> amba: use generic driver_override infrastructure >>>> cdx: use generic driver_override infrastructure >>>> hv: vmbus: use generic driver_override infrastructure >>>> rpmsg: use generic driver_override infrastructure >>> >>> I have not picked these up, as they have not received ACKs from the >>> corresponding subsystem maintainers so far. >>> >>>> bus: fsl-mc: use generic driver_override infrastructure >> >> I droped it from soc_fsl tree, some dependency must be missing. >> >> Feal free to take it if you can, it is acked-by Ioana. > > It is based on v7.0-rc5; if you want I can pick it up. Yes please pick it up as my tree is based on rc1. Thanks Christophe > >>>> spi: use generic driver_override infrastructure >>> >>> These have already been picked up via the respective subsystem trees -- thanks! >>> >>> Thanks, >>> Danilo >
On Sat Apr 4, 2026 at 7:09 PM CEST, Christophe Leroy (CS GROUP) wrote: > Yes please pick it up as my tree is based on rc1. Applied the patch to driver-core-testing, thanks!
On Tue, 24 Mar 2026 01:59:04 +0100, Danilo Krummrich wrote:
> treewide: Convert buses to use generic driver_override
>
> This is the follow-up of the driver_override generalization in [1], converting
> the remaining 11 busses and removing the now-unused driver_set_override()
> helper.
>
> All of them (except AP, which has a different race condition) are prone to the
> potential UAF described in [2], caused by accessing the driver_override field
> from their corresponding match() callback.
>
> [...]
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi.git for-7.0
Thanks!
[11/12] spi: use generic driver_override infrastructure
https://git.kernel.org/broonie/spi/c/cc34d77dd487
All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.
You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.
If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.
Please add any relevant lists and maintainers to the CCs when replying
to this mail.
Thanks,
Mark
© 2016 - 2026 Red Hat, Inc.