From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C20534F27B; Tue, 24 Mar 2026 00:59:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774313982; cv=none; b=cOTtAQzZU6YTP7HgY5W6MOKHmmdjCvoFXYiJqLKHutaZN3ID1Ts9CBmAucSYxDJ00Ld4uNg3zZdQUwXyyE5l7x7bDoqrTt+8ns2lSsBT7h53SXF7iI/U51q/vOIxG24qvAQzWTz7lHGqLSv+DuTJBEqaRtfqlXY+wAP6+SYaEcs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774313982; c=relaxed/simple; bh=o5/mDooZyQOrZSLaTUy9Q9NB3objYZ00gEDKIr30vk0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RhJ9PKIXhZA5gFYJKIh3ye7XrFnYh2tk1C6mAtLsodNOaobLAertNzx6AKMjIhXjT1f1cSI0jbN/Z+4oYhoj0x2Gn3xPD1XD7anE92K8ws7iIpnXTRsM3UK+Q+/8uVubTAhxUi8t8ZgT5KhMZMmlhUmC8p7WOGo7tBxzgy4uyWw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DeU+QBJf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DeU+QBJf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 71B53C2BCB0; Tue, 24 Mar 2026 00:59:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774313981; bh=o5/mDooZyQOrZSLaTUy9Q9NB3objYZ00gEDKIr30vk0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DeU+QBJfQMOEykZ/WseCRw8ncQ/uYJtSAPERUFs4wNJFjvV2eSGwXi54+3St1qSR0 yoc1l4FX7gt53/9/XvMnHRcN9nfHKNjkr8h3i441z0kpJEthS6at4bwtLuCRwWfwTQ zUOFjmjLi/lakrrKFe0OAiGbBQZC2pUowaUyN1Nk59BHGkOwYH5feY1hPfdn8wxuy2 UQmUcUXQvvOo9AYPJsg0ROOga1OdkZyNhVwqLzazfIXDXCjcb3ZiQGDZJxXC84R4A9 oUXH/PpxuyEXrmj7leMJZR37mYepHdDuAXgplUUb9/VB/fUvY3/ve++LVUHPkSsSG8 ggFejhQuC6MoA== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 01/12] amba: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:05 +0100 Message-ID: <20260324005919.2408620-2-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 3cf385713460 ("ARM: 8256/1: driver coamba: add device binding path '= driver_override'") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin --- drivers/amba/bus.c | 37 ++++++------------------------------- include/linux/amba/bus.h | 5 ----- 2 files changed, 6 insertions(+), 36 deletions(-) diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c index 6d479caf89cb..d721d64a9858 100644 --- a/drivers/amba/bus.c +++ b/drivers/amba/bus.c @@ -82,33 +82,6 @@ static void amba_put_disable_pclk(struct amba_device *pc= dev) } =20 =20 -static ssize_t driver_override_show(struct device *_dev, - struct device_attribute *attr, char *buf) -{ - struct amba_device *dev =3D to_amba_device(_dev); - ssize_t len; - - device_lock(_dev); - len =3D sprintf(buf, "%s\n", dev->driver_override); - device_unlock(_dev); - return len; -} - -static ssize_t driver_override_store(struct device *_dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct amba_device *dev =3D to_amba_device(_dev); - int ret; - - ret =3D driver_set_override(_dev, &dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} -static DEVICE_ATTR_RW(driver_override); - #define amba_attr_func(name,fmt,arg...) \ static ssize_t name##_show(struct device *_dev, \ struct device_attribute *attr, char *buf) \ @@ -126,7 +99,6 @@ amba_attr_func(resource, "\t%016llx\t%016llx\t%016lx\n", static struct attribute *amba_dev_attrs[] =3D { &dev_attr_id.attr, &dev_attr_resource.attr, - &dev_attr_driver_override.attr, NULL, }; ATTRIBUTE_GROUPS(amba_dev); @@ -209,10 +181,11 @@ static int amba_match(struct device *dev, const struc= t device_driver *drv) { struct amba_device *pcdev =3D to_amba_device(dev); const struct amba_driver *pcdrv =3D to_amba_driver(drv); + int ret; =20 mutex_lock(&pcdev->periphid_lock); if (!pcdev->periphid) { - int ret =3D amba_read_periphid(pcdev); + ret =3D amba_read_periphid(pcdev); =20 /* * Returning any error other than -EPROBE_DEFER from bus match @@ -230,8 +203,9 @@ static int amba_match(struct device *dev, const struct = device_driver *drv) mutex_unlock(&pcdev->periphid_lock); =20 /* When driver_override is set, only bind to the matching driver */ - if (pcdev->driver_override) - return !strcmp(pcdev->driver_override, drv->name); + ret =3D device_match_driver_override(dev, drv); + if (ret >=3D 0) + return ret; =20 return amba_lookup(pcdrv->id_table, pcdev) !=3D NULL; } @@ -436,6 +410,7 @@ static const struct dev_pm_ops amba_pm =3D { const struct bus_type amba_bustype =3D { .name =3D "amba", .dev_groups =3D amba_dev_groups, + .driver_override =3D true, .match =3D amba_match, .uevent =3D amba_uevent, .probe =3D amba_probe, diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h index 9946276aff73..6c54d5c0d21f 100644 --- a/include/linux/amba/bus.h +++ b/include/linux/amba/bus.h @@ -71,11 +71,6 @@ struct amba_device { unsigned int cid; struct amba_cs_uci_id uci; unsigned int irq[AMBA_NR_IRQS]; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; }; =20 struct amba_driver { --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93DEC19343E; Tue, 24 Mar 2026 00:59:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774313991; cv=none; b=S37ocMiRTdmYcfL4/vV1qdi4OAbN87RSy2kG/a8n1QzcDdxukKv8f71zxk4372F/gFO8aWtXOzdwI0I5MsL96htgLTNbmFwMoIzSt8idq7FbsfGHQqnWuxxxR/eaX9HL3GsEFFqL0tjQass5JWD2GzIPWMQ8dO5SEIs86Snt49Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774313991; c=relaxed/simple; bh=8SBWPlY0FpAPUZM3VGM6jk8MBe902KSJN4WiLZGAbHc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=UlUfZ0iA/ANBv0K0+84/c1p7/VQ4uL19+sxWcR3D0MKS2dYoXTW8+kyAFa6e/j+galq7T3GqDG0xPly8VBSPf1WMUAHjO/3fXEHvRJJiRoDTgCvMbtn6iaPks55+Sdcp/CZHTuWr2QBcLuLi+oO3hXKu3tWNge8mIOEv/GdvqBU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fg9y82ia; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fg9y82ia" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 138D4C4CEF7; Tue, 24 Mar 2026 00:59:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774313991; bh=8SBWPlY0FpAPUZM3VGM6jk8MBe902KSJN4WiLZGAbHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fg9y82iadfDPF6nOAy0HmPYPAiOP6FG/VDHn1TkIcmsusWoR+G/nVZNnCuZY075br gKlvWvjVdGmnI0JgptoDvayEdCUtkEYfsg2A7PluZUkmjkJczc4SoAIa2b+24cTLMO ehoUBK1kyWeitGv4Js4jW16nmf/+SUVzGnTpP2KwCYTWTgtSAqvsLMsfsTs35ptcMx Qhx+u6Ww/NKX1+DPPnLU1acTql1U6mNB+wnFZugPadRV0p5Gw0gHRTgVhOLxhxmRdq AfBcD9mRlS2Zl/SNmQhvetfwNouTevadSCvwGk1WKIFaHCmyoKhqRcaFynIdgVlqMc HA/jQLBEPF5WA== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 02/12] bus: fsl-mc: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:06 +0100 Message-ID: <20260324005919.2408620-3-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the = mc-bus") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Tested-by: Ioana Ciornei --- drivers/bus/fsl-mc/fsl-mc-bus.c | 43 +++++-------------------------- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +-- include/linux/fsl/mc.h | 4 --- 3 files changed, 8 insertions(+), 43 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bu= s.c index c117745cf206..221146e4860b 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -86,12 +86,16 @@ static int fsl_mc_bus_match(struct device *dev, const s= truct device_driver *drv) struct fsl_mc_device *mc_dev =3D to_fsl_mc_device(dev); const struct fsl_mc_driver *mc_drv =3D to_fsl_mc_driver(drv); bool found =3D false; + int ret; =20 /* When driver_override is set, only bind to the matching driver */ - if (mc_dev->driver_override) { - found =3D !strcmp(mc_dev->driver_override, mc_drv->driver.name); + ret =3D device_match_driver_override(dev, drv); + if (ret > 0) { + found =3D true; goto out; } + if (ret =3D=3D 0) + goto out; =20 if (!mc_drv->match_id_table) goto out; @@ -210,39 +214,8 @@ static ssize_t modalias_show(struct device *dev, struc= t device_attribute *attr, } static DEVICE_ATTR_RO(modalias); =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct fsl_mc_device *mc_dev =3D to_fsl_mc_device(dev); - int ret; - - if (WARN_ON(dev->bus !=3D &fsl_mc_bus_type)) - return -EINVAL; - - ret =3D driver_set_override(dev, &mc_dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct fsl_mc_device *mc_dev =3D to_fsl_mc_device(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", mc_dev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *fsl_mc_dev_attrs[] =3D { &dev_attr_modalias.attr, - &dev_attr_driver_override.attr, NULL, }; =20 @@ -345,6 +318,7 @@ ATTRIBUTE_GROUPS(fsl_mc_bus); =20 const struct bus_type fsl_mc_bus_type =3D { .name =3D "fsl-mc", + .driver_override =3D true, .match =3D fsl_mc_bus_match, .uevent =3D fsl_mc_bus_uevent, .probe =3D fsl_mc_probe, @@ -910,9 +884,6 @@ static struct notifier_block fsl_mc_nb; */ void fsl_mc_device_remove(struct fsl_mc_device *mc_dev) { - kfree(mc_dev->driver_override); - mc_dev->driver_override =3D NULL; - /* * The device-specific remove callback will get invoked by device_del() */ diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_f= sl_mc.c index 462fae1aa538..b4c3958201b2 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -424,9 +424,7 @@ static int vfio_fsl_mc_bus_notifier(struct notifier_blo= ck *nb, =20 if (action =3D=3D BUS_NOTIFY_ADD_DEVICE && vdev->mc_dev =3D=3D mc_cont) { - mc_dev->driver_override =3D kasprintf(GFP_KERNEL, "%s", - vfio_fsl_mc_ops.name); - if (!mc_dev->driver_override) + if (device_set_driver_override(dev, vfio_fsl_mc_ops.name)) dev_warn(dev, "VFIO_FSL_MC: Setting driver override for device in dprc = %s failed\n", dev_name(&mc_cont->dev)); else diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index 897d6211c163..1da63f2d7040 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -178,9 +178,6 @@ struct fsl_mc_obj_desc { * @regions: pointer to array of MMIO region entries * @irqs: pointer to array of pointers to interrupts allocated to this dev= ice * @resource: generic resource associated with this MC object device, if a= ny. - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * * Generic device object for MC object devices that are "attached" to a * MC bus. @@ -214,7 +211,6 @@ struct fsl_mc_device { struct fsl_mc_device_irq **irqs; struct fsl_mc_resource *resource; struct device_link *consumer_link; - const char *driver_override; }; =20 #define to_fsl_mc_device(_dev) \ --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5659523EAB0; Tue, 24 Mar 2026 01:00:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314001; cv=none; b=GkUotZ/jfwRGrIUVj15Gusfl6MnULIwTATvsCp7qdkYEUwPE6iRBnqRRfxl5+ZI4WUu+FFLjJPHBLE9QZUDqACKbfm3gSAlC7W9NmrN5/dXJXn9o4JoJ5RqrMW6RmHhttbt0jBajzjy9AfQwUuCazGW9jXVNv6XGv7AGpSbwcZ4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314001; c=relaxed/simple; bh=ZtCCSi+uF2o4qnuVascTL67uA5Os6ojvzLmO/D5h2Mg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qA19bzx1yfcB2E2hpKpjuq1OxKnkPin/s6bt3QoD9WzfOudczi+SRZkcs3DEHNWfBpEiygDTl78bhWy21q2adp4DUdsn5/Zykke9yBwGEyEcc33kUTv+EY9HkYdGrfZnqUEe0RfS9/rnEcgVJSQTFndJUtE7WNiypWum7pnBTsI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Nl46bkNw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Nl46bkNw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A8531C2BCB3; Tue, 24 Mar 2026 00:59:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314001; bh=ZtCCSi+uF2o4qnuVascTL67uA5Os6ojvzLmO/D5h2Mg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nl46bkNw7Fjecz/RMBLSWyx70dmK5O28lDsQW1GskyDDaiScC60RT6k4U32whSdqG vvTqf2D5QJuwkZfMIHhePdCU3vg54I+asysdiy/HM6VLVikFmJCB5Rg5z3VC4yK/OU tiset58fZbTtl2ttAsLp2cIrn8qWITtMGEZoCLr2TNkcCKmmEyAhCl7fs1cLqq3NtF 4mix3uDvddCgkLlNrSUBtMqBA8rF7s9Io0nEBzEdxR7hO0qdfUKsjfrKBksqiZ2aw1 v8gaiSPh0Qq/Pna5QKorppQaSfrb9lZ12oswLvR4sVUrPpIna0omN319f9Veo9VvTv 453J11YKXvWrw== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 03/12] cdx: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:07 +0100 Message-ID: <20260324005919.2408620-4-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 2959ab247061 ("cdx: add the cdx bus driver") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin --- drivers/cdx/cdx.c | 40 +++++-------------------------------- include/linux/cdx/cdx_bus.h | 4 ---- 2 files changed, 5 insertions(+), 39 deletions(-) diff --git a/drivers/cdx/cdx.c b/drivers/cdx/cdx.c index 9196dc50a48d..d3d230247262 100644 --- a/drivers/cdx/cdx.c +++ b/drivers/cdx/cdx.c @@ -156,8 +156,6 @@ static int cdx_unregister_device(struct device *dev, } else { cdx_destroy_res_attr(cdx_dev, MAX_CDX_DEV_RESOURCES); debugfs_remove_recursive(cdx_dev->debugfs_dir); - kfree(cdx_dev->driver_override); - cdx_dev->driver_override =3D NULL; } =20 /* @@ -268,6 +266,7 @@ static int cdx_bus_match(struct device *dev, const stru= ct device_driver *drv) const struct cdx_driver *cdx_drv =3D to_cdx_driver(drv); const struct cdx_device_id *found_id =3D NULL; const struct cdx_device_id *ids; + int ret; =20 if (cdx_dev->is_bus) return false; @@ -275,7 +274,8 @@ static int cdx_bus_match(struct device *dev, const stru= ct device_driver *drv) ids =3D cdx_drv->match_id_table; =20 /* When driver_override is set, only bind to the matching driver */ - if (cdx_dev->driver_override && strcmp(cdx_dev->driver_override, drv->nam= e)) + ret =3D device_match_driver_override(dev, drv); + if (ret =3D=3D 0) return false; =20 found_id =3D cdx_match_id(ids, cdx_dev); @@ -289,7 +289,7 @@ static int cdx_bus_match(struct device *dev, const stru= ct device_driver *drv) */ if (!found_id->override_only) return true; - if (cdx_dev->driver_override) + if (ret > 0) return true; =20 ids =3D found_id + 1; @@ -453,36 +453,6 @@ static ssize_t modalias_show(struct device *dev, struc= t device_attribute *attr, } static DEVICE_ATTR_RO(modalias); =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct cdx_device *cdx_dev =3D to_cdx_device(dev); - int ret; - - if (WARN_ON(dev->bus !=3D &cdx_bus_type)) - return -EINVAL; - - ret =3D driver_set_override(dev, &cdx_dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct cdx_device *cdx_dev =3D to_cdx_device(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", cdx_dev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static ssize_t enable_store(struct device *dev, struct device_attribute *a= ttr, const char *buf, size_t count) { @@ -552,7 +522,6 @@ static struct attribute *cdx_dev_attrs[] =3D { &dev_attr_class.attr, &dev_attr_revision.attr, &dev_attr_modalias.attr, - &dev_attr_driver_override.attr, NULL, }; =20 @@ -646,6 +615,7 @@ ATTRIBUTE_GROUPS(cdx_bus); =20 const struct bus_type cdx_bus_type =3D { .name =3D "cdx", + .driver_override =3D true, .match =3D cdx_bus_match, .probe =3D cdx_probe, .remove =3D cdx_remove, diff --git a/include/linux/cdx/cdx_bus.h b/include/linux/cdx/cdx_bus.h index b1ba97f6c9ad..f54770f110bc 100644 --- a/include/linux/cdx/cdx_bus.h +++ b/include/linux/cdx/cdx_bus.h @@ -137,9 +137,6 @@ struct cdx_controller { * @enabled: is this bus enabled * @msi_dev_id: MSI Device ID associated with CDX device * @num_msi: Number of MSI's supported by the device - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @irqchip_lock: lock to synchronize irq/msi configuration * @msi_write_pending: MSI write pending for this device */ @@ -165,7 +162,6 @@ struct cdx_device { bool enabled; u32 msi_dev_id; u32 num_msi; - const char *driver_override; struct mutex irqchip_lock; bool msi_write_pending; }; --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73E761A6813; Tue, 24 Mar 2026 01:00:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314011; cv=none; b=r+EOUq7uQbOsUzPJ+r4mPUipU1HmcPIOwNaq5RDFmapykApzsX18ybG3pT4y5V6bkOH0tupk0Nh0CUEItZg9Dc8vk+a7gz0RVo8PZQEl+3LUiZq7cIQHuiwnybmGhwuiM/NKwzwcl9vdUoT9cSSh8lcsy/t17wOYTAU6hRdFdfs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314011; c=relaxed/simple; bh=n8Np19d6r8hZP3UfKo2xpfAW6SzD3g4bxMFuAspv2o0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I47evUoeKybiw8OLEmSrA26mFzVnuIIDz1+08L3RYb7jGvj5CpcPq5DW9Wr/N143oZtyHRAlLsU7aY1qDs+VuK0E5lOMPTsepLecUqUK+2VH5VdAY0LHTUQFRbn4jlImJF1rbLySdOvvCqXIF5TwM4WGqIs8unCr5lax1QzboJA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UaBbnH6K; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UaBbnH6K" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 98196C4CEF7; Tue, 24 Mar 2026 01:00:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314011; bh=n8Np19d6r8hZP3UfKo2xpfAW6SzD3g4bxMFuAspv2o0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UaBbnH6K5PmlHRTAv2QpnB7L6Oek7DpdNRyO3DZniaipx3T4OH8aQr0MWP23mO+nu bfEd7aSy90OVPMONjSRlDR+BhJep8zQkJXj3EuTj+FdEJ7Qnz1bGziLI/rD717BPhk b0qHoXuzvssQYxYxewY0RImhKrTnweUaP7b/G+xvgY86M3nL9h5A6viQlAO4cSYSa+ cTGrxdvuLF6cPLHkd8IEp6jriRalhcgoEWJdpC8TUtaMkApKMmASLxQKpBLi0FdDUk 0+jAHYnaXmU5F6R+YbNbusudC4hG0VrqpKsYsYuN7LhJINQFVJ9EqYYng4Ywg7RJ8h GAjkf9mQ3//og== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 04/12] hv: vmbus: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:08 +0100 Message-ID: <20260324005919.2408620-5-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: d765edbb301c ("vmbus: add driver_override support") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Reviewed-by: Michael Kelley Tested-by: Michael Kelley --- drivers/hv/vmbus_drv.c | 36 +++++------------------------------- include/linux/hyperv.h | 5 ----- 2 files changed, 5 insertions(+), 36 deletions(-) diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c index bc4fc1951ae1..bc8dfd136f3c 100644 --- a/drivers/hv/vmbus_drv.c +++ b/drivers/hv/vmbus_drv.c @@ -541,34 +541,6 @@ static ssize_t device_show(struct device *dev, } static DEVICE_ATTR_RO(device); =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct hv_device *hv_dev =3D device_to_hv_device(dev); - int ret; - - ret =3D driver_set_override(dev, &hv_dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct hv_device *hv_dev =3D device_to_hv_device(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", hv_dev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - /* Set up per device attributes in /sys/bus/vmbus/devices/ */ static struct attribute *vmbus_dev_attrs[] =3D { &dev_attr_id.attr, @@ -599,7 +571,6 @@ static struct attribute *vmbus_dev_attrs[] =3D { &dev_attr_channel_vp_mapping.attr, &dev_attr_vendor.attr, &dev_attr_device.attr, - &dev_attr_driver_override.attr, NULL, }; =20 @@ -711,9 +682,11 @@ static const struct hv_vmbus_device_id *hv_vmbus_get_i= d(const struct hv_driver * { const guid_t *guid =3D &dev->dev_type; const struct hv_vmbus_device_id *id; + int ret; =20 /* When driver_override is set, only bind to the matching driver */ - if (dev->driver_override && strcmp(dev->driver_override, drv->name)) + ret =3D device_match_driver_override(&dev->device, &drv->driver); + if (ret =3D=3D 0) return NULL; =20 /* Look at the dynamic ids first, before the static ones */ @@ -722,7 +695,7 @@ static const struct hv_vmbus_device_id *hv_vmbus_get_id= (const struct hv_driver * id =3D hv_vmbus_dev_match(drv->id_table, guid); =20 /* driver_override will always match, send a dummy id */ - if (!id && dev->driver_override) + if (!id && ret > 0) id =3D &vmbus_device_null; =20 return id; @@ -1024,6 +997,7 @@ static const struct dev_pm_ops vmbus_pm =3D { /* The one and only one */ static const struct bus_type hv_bus =3D { .name =3D "vmbus", + .driver_override =3D true, .match =3D vmbus_match, .shutdown =3D vmbus_shutdown, .remove =3D vmbus_remove, diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index dfc516c1c719..bf689d07d750 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -1272,11 +1272,6 @@ struct hv_device { u16 device_id; =20 struct device device; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; =20 struct vmbus_channel *channel; struct kset *channels_kset; --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3784C30170F; Tue, 24 Mar 2026 01:00:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314021; cv=none; b=uj5mtPX5HE3CxZBTdEu2ATIKMXZCtB+xRCPeyKOYdIfxPhdjE4t8KQFjQvBeGMKE39hs81arxmpOWh8MDf5bUbvGwcK5wbRDw9yFbEi1qKiuXWWupI5QmPBaA8Q9z4ec1Wq5IPwoT85ECCe6Jh5be14JEYW8wBH81UfHdoTIEaU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314021; c=relaxed/simple; bh=zi0v4zurXgdLP04GC9K8onaZXN/N3Qlem6TWYef3iJk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=X6UONpq1P2/l4rAOhbUL0yCIb7E0tDRQXllGofKLnXU9h/YEBkhpleCpHA0D20aBGftQzk4WMsMTVkCOCIUR19eH4Need8cM0J98Do33fhtpE67oWFww9jU9t5vWy2BqMfMlMvxmrtUAv0LL5tQAAziIfsCUSFAJ2Ghpt4l7zqc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QIEgBZSe; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QIEgBZSe" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88E74C2BCB0; Tue, 24 Mar 2026 01:00:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314020; bh=zi0v4zurXgdLP04GC9K8onaZXN/N3Qlem6TWYef3iJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QIEgBZSeprBd8eco5o8dw+zg/Y5BKWKjmLND8s3b+DopMyWSHVyEjpTlL4MeXNu6J X/vMHl5tcRAtlKG5k4UUt+iHGlqdNZ7OAGIqIUnN+AuKhAX5Gfvn1RJ2JN+B+b/8oV Dnw348XctBIWTV33IkRHOMoqJWQCsfR8SsPVZoMNEUBzpdW4p6GRIYIot6LJvdMFsS 3QbEZOR+DnIpCdhzlekCzLxRc423a9T2znnXXKY+47An9vD8vHI4TrhpijQMqnokV+ 3RMAL22cwN1WStl+aUt4vfTVte+eCLX64fU0XiBT76DmRE+t61UwtJ1wkOziB9Utd8 OLcnfwwHxuprw== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 05/12] PCI: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:09 +0100 Message-ID: <20260324005919.2408620-6-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 782a985d7af2 ("PCI: Introduce new device binding path using pci_dev.= driver_override") Signed-off-by: Danilo Krummrich Acked-by: Alex Williamson Acked-by: Bjorn Helgaas Acked-by: Michael S. Tsirkin Reviewed-by: Gui-Dong Han Tested-by: Gui-Dong Han --- drivers/pci/pci-driver.c | 11 +++++++---- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 5 ++--- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 6 ------ 6 files changed, 13 insertions(+), 44 deletions(-) diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c index dd9075403987..d10ece0889f0 100644 --- a/drivers/pci/pci-driver.c +++ b/drivers/pci/pci-driver.c @@ -138,9 +138,11 @@ static const struct pci_device_id *pci_match_device(st= ruct pci_driver *drv, { struct pci_dynid *dynid; const struct pci_device_id *found_id =3D NULL, *ids; + int ret; =20 /* When driver_override is set, only bind to the matching driver */ - if (dev->driver_override && strcmp(dev->driver_override, drv->name)) + ret =3D device_match_driver_override(&dev->dev, &drv->driver); + if (ret =3D=3D 0) return NULL; =20 /* Look at the dynamic ids first, before the static ones */ @@ -164,7 +166,7 @@ static const struct pci_device_id *pci_match_device(str= uct pci_driver *drv, * matching. */ if (found_id->override_only) { - if (dev->driver_override) + if (ret > 0) return found_id; } else { return found_id; @@ -172,7 +174,7 @@ static const struct pci_device_id *pci_match_device(str= uct pci_driver *drv, } =20 /* driver_override will always match, send a dummy id */ - if (dev->driver_override) + if (ret > 0) return &pci_device_id_any; return NULL; } @@ -452,7 +454,7 @@ static int __pci_device_probe(struct pci_driver *drv, s= truct pci_dev *pci_dev) static inline bool pci_device_can_probe(struct pci_dev *pdev) { return (!pdev->is_virtfn || pdev->physfn->sriov->drivers_autoprobe || - pdev->driver_override); + device_has_driver_override(&pdev->dev)); } #else static inline bool pci_device_can_probe(struct pci_dev *pdev) @@ -1722,6 +1724,7 @@ static const struct cpumask *pci_device_irq_get_affin= ity(struct device *dev, =20 const struct bus_type pci_bus_type =3D { .name =3D "pci", + .driver_override =3D true, .match =3D pci_bus_match, .uevent =3D pci_uevent, .probe =3D pci_device_probe, diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 16eaaf749ba9..a9006cf4e9c8 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -615,33 +615,6 @@ static ssize_t devspec_show(struct device *dev, static DEVICE_ATTR_RO(devspec); #endif =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct pci_dev *pdev =3D to_pci_dev(dev); - int ret; - - ret =3D driver_set_override(dev, &pdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct pci_dev *pdev =3D to_pci_dev(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", pdev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *pci_dev_attrs[] =3D { &dev_attr_power_state.attr, &dev_attr_resource.attr, @@ -669,7 +642,6 @@ static struct attribute *pci_dev_attrs[] =3D { #ifdef CONFIG_OF &dev_attr_devspec.attr, #endif - &dev_attr_driver_override.attr, &dev_attr_ari_enabled.attr, NULL, }; diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index bccc7a4bdd79..b4707640e102 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -2488,7 +2488,6 @@ static void pci_release_dev(struct device *dev) pci_release_of_node(pci_dev); pcibios_release_device(pci_dev); pci_bus_put(pci_dev->bus); - kfree(pci_dev->driver_override); bitmap_free(pci_dev->dma_alias_mask); dev_dbg(dev, "device released\n"); kfree(pci_dev); diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_c= ore.c index d43745fe4c84..460852f79f29 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -1987,9 +1987,8 @@ static int vfio_pci_bus_notifier(struct notifier_bloc= k *nb, pdev->is_virtfn && physfn =3D=3D vdev->pdev) { pci_info(vdev->pdev, "Captured SR-IOV VF %s driver_override\n", pci_name(pdev)); - pdev->driver_override =3D kasprintf(GFP_KERNEL, "%s", - vdev->vdev.ops->name); - WARN_ON(!pdev->driver_override); + WARN_ON(device_set_driver_override(&pdev->dev, + vdev->vdev.ops->name)); } else if (action =3D=3D BUS_NOTIFY_BOUND_DRIVER && pdev->is_virtfn && physfn =3D=3D vdev->pdev) { struct pci_driver *drv =3D pci_dev_driver(pdev); diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/p= ci_stub.c index e4b27aecbf05..79a2b5dfd694 100644 --- a/drivers/xen/xen-pciback/pci_stub.c +++ b/drivers/xen/xen-pciback/pci_stub.c @@ -598,6 +598,8 @@ static int pcistub_seize(struct pci_dev *dev, return err; } =20 +static struct pci_driver xen_pcibk_pci_driver; + /* Called when 'bind'. This means we must _NOT_ call pci_reset_function or * other functions that take the sysfs lock. */ static int pcistub_probe(struct pci_dev *dev, const struct pci_device_id *= id) @@ -609,8 +611,8 @@ static int pcistub_probe(struct pci_dev *dev, const str= uct pci_device_id *id) =20 match =3D pcistub_match(dev); =20 - if ((dev->driver_override && - !strcmp(dev->driver_override, PCISTUB_DRIVER_NAME)) || + if (device_match_driver_override(&dev->dev, + &xen_pcibk_pci_driver.driver) > 0 || match) { =20 if (dev->hdr_type !=3D PCI_HEADER_TYPE_NORMAL diff --git a/include/linux/pci.h b/include/linux/pci.h index 1c270f1d5123..57e9463e4347 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -575,12 +575,6 @@ struct pci_dev { u8 supported_speeds; /* Supported Link Speeds Vector */ phys_addr_t rom; /* Physical address if not from BAR */ size_t romlen; /* Length if not from BAR */ - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; - unsigned long priv_flags; /* Private flags for the PCI driver */ =20 /* These methods index pci_reset_fn_methods[] */ --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6269367F3D; Tue, 24 Mar 2026 01:00:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314031; cv=none; b=R+DVYk+k04903426sScl4GPrju+iKPbpbF9uLtR7hfGKiFqU0BXsF7mqt66rDeTWAACUWQaKWUTRMl6JOsFAiD7LBE4RW3NOEdcyrxNs9CEN09jJIrBxH6G1rMkfKztj7OmWvAzwVnTufh6N0vTfhAgHixOr3nz97+BvnKuJwHM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314031; c=relaxed/simple; bh=dVVILhMfLU1pcFlan9xwtWDXjlzo37eXkY5X05ORIlo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Pf8BGtii7Q4nh28B9yexVYqsgbwaozqd2m8fRcw4JEoIy5Hbyi7RSE9rX/Ad+3+o6p/lS/4sfkIXzp7b5SrX97vYuPuE5qubwJvIqrDGugD8RTBQ7DKDgXPf8Dh7iRFOKD+Ha1uqqBcX8RG1PKeT/FcKje/4LPeMjWvYdlGjOYE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oy7fnz0d; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oy7fnz0d" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A3D3C4CEF7; Tue, 24 Mar 2026 01:00:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314030; bh=dVVILhMfLU1pcFlan9xwtWDXjlzo37eXkY5X05ORIlo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oy7fnz0d39vA8DeLusS4kHmpWkfMdqaP0nrRciue0f+NOlsV7gOuADpO1Y48Jjg9f MITiU8jQzjjQb8f5VUB0Og0V6KsNuJU5YifXigPhRS4NOb+330wbT3injb7ng50liP ZqYubh6zWsY6SNwUAyB+PO/HpqXevDVNbsUrBXfFeyOD+eL8N4tmQ16wvpDq7I+Ye8 iZ8d4J+xr7mwhTpSI2vWE/qgDpXkD4QpCa5xOcpu1lnxoYQaD4trGqmzV3/Z0aby4P mzbq8SomMXXsM9/OneYtf9uUKMBhTaqwO7Z3Va8LBxv8TI9anEyvFJWgLAVmMmZ6P7 5kfjdP36uus8A== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 06/12] platform/wmi: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:10 +0100 Message-ID: <20260324005919.2408620-7-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 12046f8c77e0 ("platform/x86: wmi: Add driver_override support") Signed-off-by: Danilo Krummrich Acked-by: Ilpo J=C3=A4rvinen Acked-by: Michael S. Tsirkin Reviewed-by: Armin Wolf --- drivers/platform/wmi/core.c | 36 +++++------------------------------- include/linux/wmi.h | 4 ---- 2 files changed, 5 insertions(+), 35 deletions(-) diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c index b8e6b9a421c6..750e3619724e 100644 --- a/drivers/platform/wmi/core.c +++ b/drivers/platform/wmi/core.c @@ -842,39 +842,11 @@ static ssize_t expensive_show(struct device *dev, } static DEVICE_ATTR_RO(expensive); =20 -static ssize_t driver_override_show(struct device *dev, struct device_attr= ibute *attr, - char *buf) -{ - struct wmi_device *wdev =3D to_wmi_device(dev); - ssize_t ret; - - device_lock(dev); - ret =3D sysfs_emit(buf, "%s\n", wdev->driver_override); - device_unlock(dev); - - return ret; -} - -static ssize_t driver_override_store(struct device *dev, struct device_att= ribute *attr, - const char *buf, size_t count) -{ - struct wmi_device *wdev =3D to_wmi_device(dev); - int ret; - - ret =3D driver_set_override(dev, &wdev->driver_override, buf, count); - if (ret < 0) - return ret; - - return count; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *wmi_attrs[] =3D { &dev_attr_modalias.attr, &dev_attr_guid.attr, &dev_attr_instance_count.attr, &dev_attr_expensive.attr, - &dev_attr_driver_override.attr, NULL }; ATTRIBUTE_GROUPS(wmi); @@ -943,7 +915,6 @@ static void wmi_dev_release(struct device *dev) { struct wmi_block *wblock =3D dev_to_wblock(dev); =20 - kfree(wblock->dev.driver_override); kfree(wblock); } =20 @@ -952,10 +923,12 @@ static int wmi_dev_match(struct device *dev, const st= ruct device_driver *driver) const struct wmi_driver *wmi_driver =3D to_wmi_driver(driver); struct wmi_block *wblock =3D dev_to_wblock(dev); const struct wmi_device_id *id =3D wmi_driver->id_table; + int ret; =20 /* When driver_override is set, only bind to the matching driver */ - if (wblock->dev.driver_override) - return !strcmp(wblock->dev.driver_override, driver->name); + ret =3D device_match_driver_override(dev, driver); + if (ret >=3D 0) + return ret; =20 if (id =3D=3D NULL) return 0; @@ -1076,6 +1049,7 @@ static struct class wmi_bus_class =3D { static const struct bus_type wmi_bus_type =3D { .name =3D "wmi", .dev_groups =3D wmi_groups, + .driver_override =3D true, .match =3D wmi_dev_match, .uevent =3D wmi_dev_uevent, .probe =3D wmi_dev_probe, diff --git a/include/linux/wmi.h b/include/linux/wmi.h index 75cb0c7cfe57..14fb644e1701 100644 --- a/include/linux/wmi.h +++ b/include/linux/wmi.h @@ -18,16 +18,12 @@ * struct wmi_device - WMI device structure * @dev: Device associated with this WMI device * @setable: True for devices implementing the Set Control Method - * @driver_override: Driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * * This represents WMI devices discovered by the WMI driver core. */ struct wmi_device { struct device dev; bool setable; - const char *driver_override; }; =20 /** --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 257ED36604F; Tue, 24 Mar 2026 01:00:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314040; cv=none; b=YS6typ/5Mfv/4SVVVlq6YRLaqMXtgFYCA2y1VlDO8/OwB9iWb2t8tL741eXtZiX4z79MPJppyd8l5mgBhccLZAlzf7jZ8vuNPcKi5vT+zzqwXBka6RlwfFtN/6NTSi9ln2Kuj0/mTVaFdl95Aj18ZjT+2Yn495t5JBufaEegg3o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314040; c=relaxed/simple; bh=OxPzK3/iX5TzeguT4C32klLe13a3sjO2YbS7arezVF0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=iJ1CEsyO0CSRCaIIAfvLIbj38HreVf5XksO+aEea1LQmhGf6S7O6VaUdz3bdl11Z3zzXISdaV5EjcmuOTnWOQxz7VweNjb4FesFAGsK/V2JeM3QccwLqE4NU7pnH+HvwWWqxiExfv5E7nF2Ux7jgnvc+DBLvI9tos30KgmjI2jg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DYzKa8W5; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DYzKa8W5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEA80C2BCB0; Tue, 24 Mar 2026 01:00:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314039; bh=OxPzK3/iX5TzeguT4C32klLe13a3sjO2YbS7arezVF0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DYzKa8W5KbZsX0Q3U46OAbU/nH1t2yuASEQDJe8GInk2ZFV9p/BTpJrbQ5iSVN+Rr iDsxtzXT1Q5IhpK1FpgMwK53o4dIzhC5AhsOW9v9r0Qy8xJdrXdZNw61AejuhRVV9e VgG3LgpZit11/+9g6ang/38slf+5Zbns+RQFiELF9Xyt/9STRMSAHd9hVjW2LOrKkI 9RuIqlPIejomaO8iaT6YqLBMXcEr11Es9lpiZyb/MMWt2w7I73dlPA3B+6L5DTk0yn REGuHaXz3xcd7vUQFZtCso2zZj9BStIrhcEah88ZcgAmaJ5zQO93xCdWxTK+gpJBxu ZV5PBCZyCdkKA== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 07/12] rpmsg: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:11 +0100 Message-ID: <20260324005919.2408620-8-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: e95060478244 ("rpmsg: Introduce a driver override mechanism") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Reviewed-by: Mathieu Poirier --- drivers/rpmsg/qcom_glink_native.c | 2 -- drivers/rpmsg/rpmsg_core.c | 43 +++++-------------------------- drivers/rpmsg/virtio_rpmsg_bus.c | 1 - include/linux/rpmsg.h | 4 --- 4 files changed, 7 insertions(+), 43 deletions(-) diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_n= ative.c index 9ef17c2e45b0..e9d1b2082477 100644 --- a/drivers/rpmsg/qcom_glink_native.c +++ b/drivers/rpmsg/qcom_glink_native.c @@ -1623,7 +1623,6 @@ static void qcom_glink_rpdev_release(struct device *d= ev) { struct rpmsg_device *rpdev =3D to_rpmsg_device(dev); =20 - kfree(rpdev->driver_override); kfree(rpdev); } =20 @@ -1859,7 +1858,6 @@ static void qcom_glink_device_release(struct device *= dev) =20 /* Release qcom_glink_alloc_channel() reference */ kref_put(&channel->refcount, qcom_glink_channel_release); - kfree(rpdev->driver_override); kfree(rpdev); } =20 diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c index 96964745065b..2b9f6d5a9a4f 100644 --- a/drivers/rpmsg/rpmsg_core.c +++ b/drivers/rpmsg/rpmsg_core.c @@ -358,33 +358,6 @@ rpmsg_show_attr(src, src, "0x%x\n"); rpmsg_show_attr(dst, dst, "0x%x\n"); rpmsg_show_attr(announce, announce ? "true" : "false", "%s\n"); =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct rpmsg_device *rpdev =3D to_rpmsg_device(dev); - int ret; - - ret =3D driver_set_override(dev, &rpdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct rpmsg_device *rpdev =3D to_rpmsg_device(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", rpdev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, char *buf) { @@ -405,7 +378,6 @@ static struct attribute *rpmsg_dev_attrs[] =3D { &dev_attr_dst.attr, &dev_attr_src.attr, &dev_attr_announce.attr, - &dev_attr_driver_override.attr, NULL, }; ATTRIBUTE_GROUPS(rpmsg_dev); @@ -424,9 +396,11 @@ static int rpmsg_dev_match(struct device *dev, const s= truct device_driver *drv) const struct rpmsg_driver *rpdrv =3D to_rpmsg_driver(drv); const struct rpmsg_device_id *ids =3D rpdrv->id_table; unsigned int i; + int ret; =20 - if (rpdev->driver_override) - return !strcmp(rpdev->driver_override, drv->name); + ret =3D device_match_driver_override(dev, drv); + if (ret >=3D 0) + return ret; =20 if (ids) for (i =3D 0; ids[i].name[0]; i++) @@ -535,6 +509,7 @@ static const struct bus_type rpmsg_bus =3D { .name =3D "rpmsg", .match =3D rpmsg_dev_match, .dev_groups =3D rpmsg_dev_groups, + .driver_override =3D true, .uevent =3D rpmsg_uevent, .probe =3D rpmsg_dev_probe, .remove =3D rpmsg_dev_remove, @@ -560,11 +535,9 @@ int rpmsg_register_device_override(struct rpmsg_device= *rpdev, =20 device_initialize(dev); if (driver_override) { - ret =3D driver_set_override(dev, &rpdev->driver_override, - driver_override, - strlen(driver_override)); + ret =3D device_set_driver_override(dev, driver_override); if (ret) { - dev_err(dev, "device_set_override failed: %d\n", ret); + dev_err(dev, "device_set_driver_override() failed: %d\n", ret); put_device(dev); return ret; } @@ -573,8 +546,6 @@ int rpmsg_register_device_override(struct rpmsg_device = *rpdev, ret =3D device_add(dev); if (ret) { dev_err(dev, "device_add failed: %d\n", ret); - kfree(rpdev->driver_override); - rpdev->driver_override =3D NULL; put_device(dev); } =20 diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_= bus.c index 8d9e2b4dc7c1..e0dacb736ef9 100644 --- a/drivers/rpmsg/virtio_rpmsg_bus.c +++ b/drivers/rpmsg/virtio_rpmsg_bus.c @@ -373,7 +373,6 @@ static void virtio_rpmsg_release_device(struct device *= dev) struct rpmsg_device *rpdev =3D to_rpmsg_device(dev); struct virtio_rpmsg_channel *vch =3D to_virtio_rpmsg_channel(rpdev); =20 - kfree(rpdev->driver_override); kfree(vch); } =20 diff --git a/include/linux/rpmsg.h b/include/linux/rpmsg.h index fb7ab9165645..c2e3ef8480d5 100644 --- a/include/linux/rpmsg.h +++ b/include/linux/rpmsg.h @@ -41,9 +41,6 @@ struct rpmsg_channel_info { * rpmsg_device - device that belong to the rpmsg bus * @dev: the device struct * @id: device id (used to match between rpmsg drivers and devices) - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @src: local address * @dst: destination address * @ept: the rpmsg endpoint of this channel @@ -53,7 +50,6 @@ struct rpmsg_channel_info { struct rpmsg_device { struct device dev; struct rpmsg_device_id id; - const char *driver_override; u32 src; u32 dst; struct rpmsg_endpoint *ept; --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 197C1373BF8; Tue, 24 Mar 2026 01:00:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314050; cv=none; b=tEvHq1M4zapJbmdsBPLyNQKBV46y6MeVg4IH1og9fPlM3hOXXEdKH+8uTvnQtM/4/M1OPjuT8Prb9sTJv23MraheIMLWSbqOOpg5b5gh8TKzJjS2aJs8a932KiCuewB/NCMWcdBQBKVXl4+MdYQYs+aEGwnoKEE1b2/2yZTV5DI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314050; c=relaxed/simple; bh=2lHhdrgE9qzH1ZdWMWGXkZLiIUExSh17kxoWzoBpEYw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tn4r10MH46SBtv2c/Ly9ouNQ+DCFU5PLIbMOO+I/8Cy9zHin/0o5gt2VN9u+gLdJoPovI8eN/pSCeFd5TuV98w4uTLqcL/1tODJp5XE5nWdI7Nuz/99vIo+8inwxCVIHWPycS0rJK2M8giSLlHDK4v63QKa7vtW5G/TwOYvUgtc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=urbkSyPC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="urbkSyPC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 600FAC2BCB3; Tue, 24 Mar 2026 01:00:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314049; bh=2lHhdrgE9qzH1ZdWMWGXkZLiIUExSh17kxoWzoBpEYw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=urbkSyPC//Mc+7xDMT60BWD1PM5iJno/Pv3C12Ww9BFBlm+Txslon6hgVop799Zux g+Sv+q81mxYoKpArwgNlL1ZLxKeJEZHi/lM3U9lsj91wt+dVuwPQVluFb1QQ+HQlCj sv5wTpgn5xlflwnnmanQE9E5F/Pn2wr+wAILRhGodQgtrhj4oxFDHJG9NtY75ERcHC m7A8DB8J2Ne77LkVgV0/eIo9dU9uCfUYKNhjjLT4Tt3E8Clc0+8oqnyAcHS/Bg4R5L D1zJWmU8m174lSqL3A0Ubvc3fqLrq3bwEdahRa42TfG/CVeZDK4Hwt1j/T6kr4aNVX 9oiBCcvJ5IK1g== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 08/12] vdpa: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:12 +0100 Message-ID: <20260324005919.2408620-9-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Signed-off-by: Danilo Krummrich Acked-by: Eugenio P=C3=A9rez Acked-by: Michael S. Tsirkin --- drivers/vdpa/vdpa.c | 48 +++++--------------------------------------- include/linux/vdpa.h | 4 ---- 2 files changed, 5 insertions(+), 47 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index 34874beb0152..caf0ee5d6856 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) =20 static int vdpa_dev_match(struct device *dev, const struct device_driver *= drv) { - struct vdpa_device *vdev =3D dev_to_vdpa(dev); + int ret; =20 /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) =3D=3D 0; + ret =3D device_match_driver_override(dev, drv); + if (ret >=3D 0) + return ret; =20 /* Currently devices must be supported by all vDPA bus drivers */ return 1; } =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev =3D dev_to_vdpa(dev); - int ret; - - ret =3D driver_set_override(dev, &vdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev =3D dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] =3D { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group =3D { - .attrs =3D vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - static const struct bus_type vdpa_bus =3D { .name =3D "vdpa", - .dev_groups =3D vdpa_dev_groups, + .driver_override =3D true, .match =3D vdpa_dev_match, .probe =3D vdpa_dev_probe, .remove =3D vdpa_dev_remove, @@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); =20 ida_free(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } =20 diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 2bfe3baa63f4..782c42d25db1 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -72,9 +72,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @vmap: the metadata passed to upper layer to be used for mapping - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @config: the configuration ops for this device. * @map: the map ops for this device * @cf_lock: Protects get and set access to configuration layout. @@ -90,7 +87,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; union virtio_map vmap; - const char *driver_override; const struct vdpa_config_ops *config; const struct virtio_map_ops *map; struct rw_semaphore cf_lock; /* Protects get/set config */ --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D4FBD26B2D7; Tue, 24 Mar 2026 01:00:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314060; cv=none; b=EQc3zpUBXNJx+IVvDbes/DUtX2zOLM4+vcxlk9tuqFWP+ar+Z4dzgQj6Ad+DcB5OjEoCmicvsnm/KZo30I11IvJNiv3IRmB1iGwTboE1v/nSuJ+xRNOrQ2tNuKn3qwI0LFUTLyRAupGS3xEVpF7uTGxxDWerqxRqZ5Ib10gzhT8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314060; c=relaxed/simple; bh=ByobimVvZngWYiBS4MISNoCZaILbn7MyP0EmUHxONX8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MWKcbVTBAEbeqdJiexodqk7aQQzR0bdjo5y8066l/A6nKTofZr0Nr9u5OJTA7t+IuWIUbYeHJkRACSnUJOBSRkpr98cPoiKw5hBp4XNdgV/fnYIgC6c5BwSALn2/730CYj9G/pyg0i8JZPhBd1+sOL59E9am07KNVicMVaNO5vI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=M5cmM+6D; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="M5cmM+6D" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F37F1C4CEF7; Tue, 24 Mar 2026 01:00:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314059; bh=ByobimVvZngWYiBS4MISNoCZaILbn7MyP0EmUHxONX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M5cmM+6DyqmK+EAGRvLHS/yaDqvmCvw5jU4r7SCyXiBwcQBFFqbb4X/i4pXN2bi2S gHkRbl+Xo3RELYoiG4jfGiG71cPBeRkIjOhdvO7LyCtTJjVMWWsggEZfDrMHEQh/LT sJPml12ZLm2ZXWcUV7+rSBuPDv4wlXIGpfa5Mp3UMgF0NSXsREGrGnuvEljzT3nxKU rRCqRHzFA+L/AZEsNVivSFaFs9zyzzt9OOmEyPjs+2mnPiQ4PBAEg9i9nAYF6+ohUT 5vkv2XGga3nnGd1hHPKmfzckD1wY8wwkbKkdLTe4mZgsX9KBZZceAs6EiZe7MaJYyF N2W+3BMlOYL3w== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 09/12] s390/cio: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:13 +0100 Message-ID: <20260324005919.2408620-10-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: ebc3d1791503 ("s390/cio: introduce driver_override on the css bus") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Reviewed-by: Vineeth Vijayan --- drivers/s390/cio/cio.h | 5 ----- drivers/s390/cio/css.c | 34 ++++------------------------------ 2 files changed, 4 insertions(+), 35 deletions(-) diff --git a/drivers/s390/cio/cio.h b/drivers/s390/cio/cio.h index 08a5e9380e75..bad142c536e1 100644 --- a/drivers/s390/cio/cio.h +++ b/drivers/s390/cio/cio.h @@ -103,11 +103,6 @@ struct subchannel { struct work_struct todo_work; struct schib_config config; u64 dma_mask; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; } __attribute__ ((aligned(8))); =20 DECLARE_PER_CPU_ALIGNED(struct irb, cio_irb); diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 5ab239f38588..e5a0ec6b4e3e 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -159,7 +159,6 @@ static void css_subchannel_release(struct device *dev) =20 sch->config.intparm =3D 0; cio_commit_config(sch); - kfree(sch->driver_override); kfree(sch); } =20 @@ -323,37 +322,9 @@ static ssize_t modalias_show(struct device *dev, struc= t device_attribute *attr, =20 static DEVICE_ATTR_RO(modalias); =20 -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct subchannel *sch =3D to_subchannel(dev); - int ret; - - ret =3D driver_set_override(dev, &sch->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct subchannel *sch =3D to_subchannel(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", sch->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *subch_attrs[] =3D { &dev_attr_type.attr, &dev_attr_modalias.attr, - &dev_attr_driver_override.attr, NULL, }; =20 @@ -1356,9 +1327,11 @@ static int css_bus_match(struct device *dev, const s= truct device_driver *drv) struct subchannel *sch =3D to_subchannel(dev); const struct css_driver *driver =3D to_cssdriver(drv); struct css_device_id *id; + int ret; =20 /* When driver_override is set, only bind to the matching driver */ - if (sch->driver_override && strcmp(sch->driver_override, drv->name)) + ret =3D device_match_driver_override(dev, drv); + if (ret =3D=3D 0) return 0; =20 for (id =3D driver->subchannel_type; id->match_flags; id++) { @@ -1415,6 +1388,7 @@ static int css_uevent(const struct device *dev, struc= t kobj_uevent_env *env) =20 static const struct bus_type css_bus_type =3D { .name =3D "css", + .driver_override =3D true, .match =3D css_bus_match, .probe =3D css_probe, .remove =3D css_remove, --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DA99681ACA; Tue, 24 Mar 2026 01:01:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314068; cv=none; b=mMm/T3BRFFp5sYTc+AZ+dU8XWe7Viq5iBG3nxNs9mkk1/xxg7wRXJKx4FUKj5ZpaKYHhdjuZVu6d9crYBoJdaruHgsS51j03OnDFdwZQyghfjuZXpEuyHtOfClsob/hARziekDxlg+P2Lly3mp65Rp+3KV8lEZ5cCzkyhZ33FAc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314068; c=relaxed/simple; bh=A7+ilLlUptt8NahoteAzf0RgIRgwKuFBHYBpfbQD/9c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=t5NVkRfPG+yFRveexDWi3ejtqeh7POuy/lOtInHRoimQdK5na70FCm/fZOg94ItBvEajm9UyqVJUzEjmGUX8o6xO8lKjE3dj4Mcog5gvtpMBv/RnuGRBBrYlWJCJrTsd2TjXK6V2WW5OiuRwNMfkz5pvvngtCZ8ctpM+d5E2DEc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=erU7fvhz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="erU7fvhz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 931DBC2BCB0; Tue, 24 Mar 2026 01:00:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314068; bh=A7+ilLlUptt8NahoteAzf0RgIRgwKuFBHYBpfbQD/9c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=erU7fvhzJv2tp5KrkKrqx+Erdif01ZeeUOpNA4f3SMGY5Zd3volrXG0e/GJE1PA+4 eGQrxZX3PAs12r5SMw5wVj3Dru900+u5sZlt2HAhjsWXohecP7okhBQJqUVMGYmK9x t4JpMcZVTz48+PY+wk5zYrMxets8K+lB6YlpzvSaaUxQizoh9N8ogOZ6kZFkBtVUt/ +2U/I6kRnURbopqcXHThSae0+v5nsjA+MtxnO1+6Qp2DXSnViA+Sg/1CnS+DYaIbv9 MmwreYV6dk6ePxO92r/nW6iGASWXgbC1mouwugaLRXGpdUBgdYK22pwqvUSENOqNbX RFBSTYbpYZsGA== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich Subject: [PATCH 10/12] s390/ap: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:14 +0100 Message-ID: <20260324005919.2408620-11-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When the AP masks are updated via apmask_store() or aqmask_store(), ap_bus_revise_bindings() is called after ap_attr_mutex has been released. This calls __ap_revise_reserved(), which accesses the driver_override field without holding any lock, racing against a concurrent driver_override_store() that may free the old string, resulting in a potential UAF. Fix this by using the driver-core driver_override infrastructure, which protects all accesses with an internal spinlock. Note that unlike most other buses, the AP bus does not check driver_override in its match() callback; the override is checked in ap_device_probe() and __ap_revise_reserved() instead. Also note that we do not enable the driver_override feature of struct bus_type, as AP - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Additionally, AP has a custom counter that is modified in the corresponding custom driver_override_store(). Fixes: d38a87d7c064 ("s390/ap: Support driver_override for AP queue devices= ") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Reviewed-by: Harald Freudenberger Reviewed-by: Holger Dengler Tested-by: Holger Dengler --- drivers/s390/crypto/ap_bus.c | 34 +++++++++++++++++----------------- drivers/s390/crypto/ap_bus.h | 1 - drivers/s390/crypto/ap_queue.c | 24 ++++++------------------ 3 files changed, 23 insertions(+), 36 deletions(-) diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c index d652df96a507..f24e27add721 100644 --- a/drivers/s390/crypto/ap_bus.c +++ b/drivers/s390/crypto/ap_bus.c @@ -859,25 +859,24 @@ static int __ap_queue_devices_with_id_unregister(stru= ct device *dev, void *data) =20 static int __ap_revise_reserved(struct device *dev, void *dummy) { - int rc, card, queue, devres, drvres; + int rc, card, queue, devres, drvres, ovrd; =20 if (is_queue_dev(dev)) { struct ap_driver *ap_drv =3D to_ap_drv(dev->driver); struct ap_queue *aq =3D to_ap_queue(dev); - struct ap_device *ap_dev =3D &aq->ap_dev; =20 card =3D AP_QID_CARD(aq->qid); queue =3D AP_QID_QUEUE(aq->qid); =20 - if (ap_dev->driver_override) { - if (strcmp(ap_dev->driver_override, - ap_drv->driver.name)) { - pr_debug("reprobing queue=3D%02x.%04x\n", card, queue); - rc =3D device_reprobe(dev); - if (rc) { - AP_DBF_WARN("%s reprobing queue=3D%02x.%04x failed\n", - __func__, card, queue); - } + ovrd =3D device_match_driver_override(dev, &ap_drv->driver); + if (ovrd > 0) { + /* override set and matches, nothing to do */ + } else if (ovrd =3D=3D 0) { + pr_debug("reprobing queue=3D%02x.%04x\n", card, queue); + rc =3D device_reprobe(dev); + if (rc) { + AP_DBF_WARN("%s reprobing queue=3D%02x.%04x failed\n", + __func__, card, queue); } } else { mutex_lock(&ap_attr_mutex); @@ -928,7 +927,7 @@ int ap_owned_by_def_drv(int card, int queue) if (aq) { const struct device_driver *drv =3D aq->ap_dev.device.driver; const struct ap_driver *ap_drv =3D to_ap_drv(drv); - bool override =3D !!aq->ap_dev.driver_override; + bool override =3D device_has_driver_override(&aq->ap_dev.device); =20 if (override && drv && ap_drv->flags & AP_DRIVER_FLAG_DEFAULT) rc =3D 1; @@ -977,7 +976,7 @@ static int ap_device_probe(struct device *dev) { struct ap_device *ap_dev =3D to_ap_dev(dev); struct ap_driver *ap_drv =3D to_ap_drv(dev->driver); - int card, queue, devres, drvres, rc =3D -ENODEV; + int card, queue, devres, drvres, rc =3D -ENODEV, ovrd; =20 if (!get_device(dev)) return rc; @@ -991,10 +990,11 @@ static int ap_device_probe(struct device *dev) */ card =3D AP_QID_CARD(to_ap_queue(dev)->qid); queue =3D AP_QID_QUEUE(to_ap_queue(dev)->qid); - if (ap_dev->driver_override) { - if (strcmp(ap_dev->driver_override, - ap_drv->driver.name)) - goto out; + ovrd =3D device_match_driver_override(dev, &ap_drv->driver); + if (ovrd > 0) { + /* override set and matches, nothing to do */ + } else if (ovrd =3D=3D 0) { + goto out; } else { mutex_lock(&ap_attr_mutex); devres =3D test_bit_inv(card, ap_perms.apm) && diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h index 51e08f27bd75..04ea256ecf91 100644 --- a/drivers/s390/crypto/ap_bus.h +++ b/drivers/s390/crypto/ap_bus.h @@ -166,7 +166,6 @@ void ap_driver_unregister(struct ap_driver *); struct ap_device { struct device device; int device_type; /* AP device type. */ - const char *driver_override; }; =20 #define to_ap_dev(x) container_of((x), struct ap_device, device) diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c index 3fe2e41c5c6b..ca9819e6f7e7 100644 --- a/drivers/s390/crypto/ap_queue.c +++ b/drivers/s390/crypto/ap_queue.c @@ -734,26 +734,14 @@ static ssize_t driver_override_show(struct device *de= v, struct device_attribute *attr, char *buf) { - struct ap_queue *aq =3D to_ap_queue(dev); - struct ap_device *ap_dev =3D &aq->ap_dev; - int rc; - - device_lock(dev); - if (ap_dev->driver_override) - rc =3D sysfs_emit(buf, "%s\n", ap_dev->driver_override); - else - rc =3D sysfs_emit(buf, "\n"); - device_unlock(dev); - - return rc; + guard(spinlock)(&dev->driver_override.lock); + return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: ""); } =20 static ssize_t driver_override_store(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) { - struct ap_queue *aq =3D to_ap_queue(dev); - struct ap_device *ap_dev =3D &aq->ap_dev; int rc =3D -EINVAL; bool old_value; =20 @@ -764,13 +752,13 @@ static ssize_t driver_override_store(struct device *d= ev, if (ap_apmask_aqmask_in_use) goto out; =20 - old_value =3D ap_dev->driver_override ? true : false; - rc =3D driver_set_override(dev, &ap_dev->driver_override, buf, count); + old_value =3D device_has_driver_override(dev); + rc =3D __device_set_driver_override(dev, buf, count); if (rc) goto out; - if (old_value && !ap_dev->driver_override) + if (old_value && !device_has_driver_override(dev)) --ap_driver_override_ctr; - else if (!old_value && ap_dev->driver_override) + else if (!old_value && device_has_driver_override(dev)) ++ap_driver_override_ctr; =20 rc =3D count; --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D1D4363C66; Tue, 24 Mar 2026 01:01:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314078; cv=none; b=KNcVZJ4G5p2Fq8Aw78O0pG4op17hZg48RjFXSpJQCYy+8GZeUX+Ot9KwgJxW0WzPP2IqpjWX614D4Fda8YuQZ4ynvRTd0TFFLXinfhidjrrFkR0Jep3uIC6q+IMV9FPasjYTX05dBVtZrv/8bz9WXli6Ekqsh287Ya1cLyfpos4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314078; c=relaxed/simple; bh=TSvMQrmWsjFbNL0IRf0H97QbCggIeEqWbPsKuLbLU4A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Zd8WEP9+R2LXYz81hAxlMd8wcZKd3hZBnjlhOurC75eXrcHZ+OlJ6QWpUROU9sG09CxhgahG4OgO2hZoxw7pzV/XFpOynBJdqCZ9lkUzApP/nJQyv8E+XHI9WtbLeSG34GXSz/4udAn/Ru2mCthkwVMzdunq+Gn5PDo+vaK+t2o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Nt7EnChi; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Nt7EnChi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 08877C4CEF7; Tue, 24 Mar 2026 01:01:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314078; bh=TSvMQrmWsjFbNL0IRf0H97QbCggIeEqWbPsKuLbLU4A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nt7EnChiw/TSy7uxZL1NGCwc80dLd1NcsHa2f5yOYAsRoEuKZz3R4Zc2Jky7pI1PP fX38CD0xPqsoAlbl8ygm7B7pQvUt21fJRqnuUoJzuGo/w1SwTYIkOuYMzYD6++PKyO GlReyOV0V5oiuGn3d19d+P/0YVof0JWBUjpR7gvA94kKmmZrfsVK4M+LbO6J+BIjBR GNNZS00+k7bbnjV9HfcGI/slE84pV5D8Pfilwv3HA2XN5pcxtA4pjQBZ0SSOkup/06 D6VUmZOVMXZtjDLE4b4uCWJCE0Qw6XcyAZU2CAHH+xAz/p1g0p71QYF5eQjsqdnxat 5+zw/NsuVO7yw== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich , Gui-Dong Han Subject: [PATCH 11/12] spi: use generic driver_override infrastructure Date: Tue, 24 Mar 2026 01:59:15 +0100 Message-ID: <20260324005919.2408620-12-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel= .org/ [1] Reported-by: Gui-Dong Han Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Fixes: 5039563e7c25 ("spi: Add driver_override SPI device attribute") Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin --- drivers/spi/spi.c | 19 +++++++------------ include/linux/spi/spi.h | 5 ----- 2 files changed, 7 insertions(+), 17 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 53dee314d76a..4101c2803eb3 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -50,7 +50,6 @@ static void spidev_release(struct device *dev) struct spi_device *spi =3D to_spi_device(dev); =20 spi_controller_put(spi->controller); - kfree(spi->driver_override); free_percpu(spi->pcpu_statistics); kfree(spi); } @@ -73,10 +72,9 @@ static ssize_t driver_override_store(struct device *dev, struct device_attribute *a, const char *buf, size_t count) { - struct spi_device *spi =3D to_spi_device(dev); int ret; =20 - ret =3D driver_set_override(dev, &spi->driver_override, buf, count); + ret =3D __device_set_driver_override(dev, buf, count); if (ret) return ret; =20 @@ -86,13 +84,8 @@ static ssize_t driver_override_store(struct device *dev, static ssize_t driver_override_show(struct device *dev, struct device_attribute *a, char *buf) { - const struct spi_device *spi =3D to_spi_device(dev); - ssize_t len; - - device_lock(dev); - len =3D sysfs_emit(buf, "%s\n", spi->driver_override ? : ""); - device_unlock(dev); - return len; + guard(spinlock)(&dev->driver_override.lock); + return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: ""); } static DEVICE_ATTR_RW(driver_override); =20 @@ -376,10 +369,12 @@ static int spi_match_device(struct device *dev, const= struct device_driver *drv) { const struct spi_device *spi =3D to_spi_device(dev); const struct spi_driver *sdrv =3D to_spi_driver(drv); + int ret; =20 /* Check override first, and if set, only use the named driver */ - if (spi->driver_override) - return strcmp(spi->driver_override, drv->name) =3D=3D 0; + ret =3D device_match_driver_override(dev, drv); + if (ret >=3D 0) + return ret; =20 /* Attempt an OF style match */ if (of_driver_match_device(dev, drv)) diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index af7cfee7b8f6..0dc671c07d3a 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -159,10 +159,6 @@ extern void spi_transfer_cs_change_delay_exec(struct s= pi_message *msg, * @modalias: Name of the driver to use with this device, or an alias * for that name. This appears in the sysfs "modalias" attribute * for driver coldplugging, and in uevents used for hotplugging - * @driver_override: If the name of a driver is written to this attribute,= then - * the device will bind to the named driver and only the named driver. - * Do not set directly, because core frees it; use driver_set_override() to - * set or clear it. * @pcpu_statistics: statistics for the spi_device * @word_delay: delay to be inserted between consecutive * words of a transfer @@ -224,7 +220,6 @@ struct spi_device { void *controller_state; void *controller_data; char modalias[SPI_NAME_SIZE]; - const char *driver_override; =20 /* The statistics */ struct spi_statistics __percpu *pcpu_statistics; --=20 2.53.0 From nobody Sun Apr 5 16:29:44 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3AB123EAB0; Tue, 24 Mar 2026 01:01:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314088; cv=none; b=MV5ViPufvcxZLp6lYOZU9EuJXDVanlC9nKqdacvdQPVNO1sDVIZz87zvX3vp4oANRnegtkIt/BSKCr6eUvjD5CJfhJdhwWHcSix/yx2jP6mNSICquRgOPi6a/5xm54bBYpcEiC1R01mKVtt2k/WKDB664YC0GABucpDRuvuYdeo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774314088; c=relaxed/simple; bh=KpxTlQdpK2jKnd62P5I8EEqT3CEkSotjkNoM+lvw6Dc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I4LSTj0Rg4rK6KZ+W4mHDCzkVVLaCZWx3Vn9ruf1FNrfMYs3np1aZj7aA4jloOdvTe11JHey/EcXmxJOWkjsdm3CTmk3gaOAz3qKWdaKXM0+P9Cdnv1phyzymc9QgjSWTKriMQcruVXDK6lcGsIRT4UzISai3BMPJPaidC73YhY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rLAmVR6g; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rLAmVR6g" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C0E8C4CEF7; Tue, 24 Mar 2026 01:01:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774314087; bh=KpxTlQdpK2jKnd62P5I8EEqT3CEkSotjkNoM+lvw6Dc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rLAmVR6groUQSZRplygjMn68KJDDiLrGR9Vctd6Afc3mLDKzHEaYGbMFZ3KXs4fK4 MUoXCr/h6SfvTEE4yAlc7KGjraQ8CFJXtGn8f5BkmJWMm1J/pjXgfy9qXciydDWGLj XNYlWwVjufJG5KD0z7v9ARc0FuEyAjjiYRe15HPbrYCuuNFi4/b/eyHrklVGEVsCSm lE5k5muPCMjo/9hKdfl5T5LohS8mNpZoGcTFibqf76OQzdeH43NHUrx9bEVbSisncq g/N4LXJNuBtUlzaGXa8b6D8KnPgXir5STaz/+AS+2urYkPCvbB6vpDfKREYcWyPp9d 47Lib8DntPlsA== From: Danilo Krummrich To: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?q?Eugenio=20P=C3=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" Cc: linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Danilo Krummrich Subject: [PATCH 12/12] driver core: remove driver_set_override() Date: Tue, 24 Mar 2026 01:59:16 +0100 Message-ID: <20260324005919.2408620-13-dakr@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org> References: <20260324005919.2408620-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" All buses have been converted from driver_set_override() to the generic driver_override infrastructure introduced in commit cb3d1049f4ea ("driver core: generalize driver_override in struct device"). Buses now either opt into the generic sysfs callbacks via the bus_type::driver_override flag, or use device_set_driver_override() / __device_set_driver_override() directly. Thus, remove the now-unused driver_set_override() helper. Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 Signed-off-by: Danilo Krummrich Acked-by: Michael S. Tsirkin Reviewed-by: Greg Kroah-Hartman --- drivers/base/driver.c | 75 ----------------------------------- include/linux/device/driver.h | 2 - 2 files changed, 77 deletions(-) diff --git a/drivers/base/driver.c b/drivers/base/driver.c index 8ab010ddf709..7ed834f7199c 100644 --- a/drivers/base/driver.c +++ b/drivers/base/driver.c @@ -30,81 +30,6 @@ static struct device *next_device(struct klist_iter *i) return dev; } =20 -/** - * driver_set_override() - Helper to set or clear driver override. - * @dev: Device to change - * @override: Address of string to change (e.g. &device->driver_override); - * The contents will be freed and hold newly allocated override. - * @s: NUL-terminated string, new driver name to force a match, pass empty - * string to clear it ("" or "\n", where the latter is only for sysfs - * interface). - * @len: length of @s - * - * Helper to set or clear driver override in a device, intended for the ca= ses - * when the driver_override field is allocated by driver/bus code. - * - * Returns: 0 on success or a negative error code on failure. - */ -int driver_set_override(struct device *dev, const char **override, - const char *s, size_t len) -{ - const char *new, *old; - char *cp; - - if (!override || !s) - return -EINVAL; - - /* - * The stored value will be used in sysfs show callback (sysfs_emit()), - * which has a length limit of PAGE_SIZE and adds a trailing newline. - * Thus we can store one character less to avoid truncation during sysfs - * show. - */ - if (len >=3D (PAGE_SIZE - 1)) - return -EINVAL; - - /* - * Compute the real length of the string in case userspace sends us a - * bunch of \0 characters like python likes to do. - */ - len =3D strlen(s); - - if (!len) { - /* Empty string passed - clear override */ - device_lock(dev); - old =3D *override; - *override =3D NULL; - device_unlock(dev); - kfree(old); - - return 0; - } - - cp =3D strnchr(s, len, '\n'); - if (cp) - len =3D cp - s; - - new =3D kstrndup(s, len, GFP_KERNEL); - if (!new) - return -ENOMEM; - - device_lock(dev); - old =3D *override; - if (cp !=3D s) { - *override =3D new; - } else { - /* "\n" passed - clear override */ - kfree(new); - *override =3D NULL; - } - device_unlock(dev); - - kfree(old); - - return 0; -} -EXPORT_SYMBOL_GPL(driver_set_override); - /** * driver_for_each_device - Iterator for devices bound to a driver. * @drv: Driver we're iterating. diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h index bbc67ec513ed..aa3465a369f0 100644 --- a/include/linux/device/driver.h +++ b/include/linux/device/driver.h @@ -160,8 +160,6 @@ int __must_check driver_create_file(const struct device= _driver *driver, void driver_remove_file(const struct device_driver *driver, const struct driver_attribute *attr); =20 -int driver_set_override(struct device *dev, const char **override, - const char *s, size_t len); int __must_check driver_for_each_device(struct device_driver *drv, struct = device *start, void *data, device_iter_t fn); struct device *driver_find_device(const struct device_driver *drv, --=20 2.53.0