drivers/base/base.h | 2 ++ drivers/base/bus.c | 16 +++++++++++----- drivers/base/dd.c | 2 ++ 3 files changed, 15 insertions(+), 5 deletions(-)
Currently, driver_match_device() is called from three sites. One site
(__device_attach_driver) holds device_lock(dev), but the other two
(bind_store and __driver_attach) do not. This inconsistency means that
bus match() callbacks are not guaranteed to be called with the lock
held.
Fix this by holding device_lock(dev) around the driver_match_device()
calls in bind_store() and __driver_attach(). This ensures consistent
locking for all match() callbacks. Also add a lock assertion to
driver_match_device() to enforce this guarantee.
This consistency also fixes a known race condition. The driver_override
implementation relies on the device_lock, so the missing lock led to the
use-after-free (UAF) reported in Bugzilla for buses using this field.
Stress testing the two newly locked paths for 24 hours with
CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
and no lockdep warnings.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
---
v4:
* Remove the misleading comment above device_lock_assert(), and update
subject and commit message to focus on enforcing consistent locking,
as discussed with Danilo Krummrich.
v3:
* Remove redundant locking comments at call sites and add a blank line
after the lock assertion in driver_match_device(), as suggested by Greg KH.
v2:
* Add device_lock_assert() in driver_match_device() to enforce locking
requirement, as suggested by Greg KH.
v1:
* The Bugzilla entry contains full KASAN reports and two PoCs that reliably
reproduce the UAF on both unlocked paths using a standard QEMU setup
(default e1000 device at 0000:00:03.0).
---
drivers/base/base.h | 2 ++
drivers/base/bus.c | 16 +++++++++++-----
drivers/base/dd.c | 2 ++
3 files changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/base/base.h b/drivers/base/base.h
index 430cbefbc97f..aa701878c6e3 100644
--- a/drivers/base/base.h
+++ b/drivers/base/base.h
@@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
static inline int driver_match_device(const struct device_driver *drv,
struct device *dev)
{
+ device_lock_assert(dev);
+
return drv->bus->match ? drv->bus->match(dev, drv) : 1;
}
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index 9eb7771706f0..5cbcf9f5bd6e 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
const struct bus_type *bus = bus_get(drv->bus);
struct device *dev;
int err = -ENODEV;
+ int ret;
dev = bus_find_device_by_name(bus, NULL, buf);
- if (dev && driver_match_device(drv, dev)) {
- err = device_driver_attach(drv, dev);
- if (!err) {
- /* success */
- err = count;
+ if (dev) {
+ device_lock(dev);
+ ret = driver_match_device(drv, dev);
+ device_unlock(dev);
+ if (ret) {
+ err = device_driver_attach(drv, dev);
+ if (!err) {
+ /* success */
+ err = count;
+ }
}
}
put_device(dev);
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 349f31bedfa1..e79c732a56e4 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
* is an error.
*/
+ device_lock(dev);
ret = driver_match_device(drv, dev);
+ device_unlock(dev);
if (ret == 0) {
/* no match */
return 0;
--
2.43.0On Tue, Jan 13, 2026 at 4:05 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
>
> Currently, driver_match_device() is called from three sites. One site
> (__device_attach_driver) holds device_lock(dev), but the other two
> (bind_store and __driver_attach) do not. This inconsistency means that
> bus match() callbacks are not guaranteed to be called with the lock
> held.
>
> Fix this by holding device_lock(dev) around the driver_match_device()
> calls in bind_store() and __driver_attach(). This ensures consistent
> locking for all match() callbacks. Also add a lock assertion to
> driver_match_device() to enforce this guarantee.
>
> This consistency also fixes a known race condition. The driver_override
> implementation relies on the device_lock, so the missing lock led to the
> use-after-free (UAF) reported in Bugzilla for buses using this field.
>
> Stress testing the two newly locked paths for 24 hours with
> CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
> and no lockdep warnings.
>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> ---
> v4:
> * Remove the misleading comment above device_lock_assert(), and update
> subject and commit message to focus on enforcing consistent locking,
> as discussed with Danilo Krummrich.
> v3:
> * Remove redundant locking comments at call sites and add a blank line
> after the lock assertion in driver_match_device(), as suggested by Greg KH.
> v2:
> * Add device_lock_assert() in driver_match_device() to enforce locking
> requirement, as suggested by Greg KH.
> v1:
> * The Bugzilla entry contains full KASAN reports and two PoCs that reliably
> reproduce the UAF on both unlocked paths using a standard QEMU setup
> (default e1000 device at 0000:00:03.0).
> ---
> drivers/base/base.h | 2 ++
> drivers/base/bus.c | 16 +++++++++++-----
> drivers/base/dd.c | 2 ++
> 3 files changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/base/base.h b/drivers/base/base.h
> index 430cbefbc97f..aa701878c6e3 100644
> --- a/drivers/base/base.h
> +++ b/drivers/base/base.h
> @@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
> static inline int driver_match_device(const struct device_driver *drv,
> struct device *dev)
> {
> + device_lock_assert(dev);
> +
> return drv->bus->match ? drv->bus->match(dev, drv) : 1;
> }
>
> diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> index 9eb7771706f0..5cbcf9f5bd6e 100644
> --- a/drivers/base/bus.c
> +++ b/drivers/base/bus.c
> @@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
> const struct bus_type *bus = bus_get(drv->bus);
> struct device *dev;
> int err = -ENODEV;
> + int ret;
>
> dev = bus_find_device_by_name(bus, NULL, buf);
> - if (dev && driver_match_device(drv, dev)) {
> - err = device_driver_attach(drv, dev);
> - if (!err) {
> - /* success */
> - err = count;
> + if (dev) {
> + device_lock(dev);
> + ret = driver_match_device(drv, dev);
> + device_unlock(dev);
> + if (ret) {
> + err = device_driver_attach(drv, dev);
> + if (!err) {
> + /* success */
> + err = count;
> + }
> }
> }
> put_device(dev);
> diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> index 349f31bedfa1..e79c732a56e4 100644
> --- a/drivers/base/dd.c
> +++ b/drivers/base/dd.c
> @@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
> * is an error.
> */
>
> + device_lock(dev);
> ret = driver_match_device(drv, dev);
> + device_unlock(dev);
This repeats the pattern above, so maybe add a helper function for it?
And use the device guard in there?
> if (ret == 0) {
> /* no match */
> return 0;
> --
On Tue, Jan 13, 2026 at 11:20 PM Rafael J. Wysocki <rafael@kernel.org> wrote:
>
> On Tue, Jan 13, 2026 at 4:05 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
> >
> > Currently, driver_match_device() is called from three sites. One site
> > (__device_attach_driver) holds device_lock(dev), but the other two
> > (bind_store and __driver_attach) do not. This inconsistency means that
> > bus match() callbacks are not guaranteed to be called with the lock
> > held.
> >
> > Fix this by holding device_lock(dev) around the driver_match_device()
> > calls in bind_store() and __driver_attach(). This ensures consistent
> > locking for all match() callbacks. Also add a lock assertion to
> > driver_match_device() to enforce this guarantee.
> >
> > This consistency also fixes a known race condition. The driver_override
> > implementation relies on the device_lock, so the missing lock led to the
> > use-after-free (UAF) reported in Bugzilla for buses using this field.
> >
> > Stress testing the two newly locked paths for 24 hours with
> > CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
> > and no lockdep warnings.
> >
> > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> > Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
> > Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> > ---
> > v4:
> > * Remove the misleading comment above device_lock_assert(), and update
> > subject and commit message to focus on enforcing consistent locking,
> > as discussed with Danilo Krummrich.
> > v3:
> > * Remove redundant locking comments at call sites and add a blank line
> > after the lock assertion in driver_match_device(), as suggested by Greg KH.
> > v2:
> > * Add device_lock_assert() in driver_match_device() to enforce locking
> > requirement, as suggested by Greg KH.
> > v1:
> > * The Bugzilla entry contains full KASAN reports and two PoCs that reliably
> > reproduce the UAF on both unlocked paths using a standard QEMU setup
> > (default e1000 device at 0000:00:03.0).
> > ---
> > drivers/base/base.h | 2 ++
> > drivers/base/bus.c | 16 +++++++++++-----
> > drivers/base/dd.c | 2 ++
> > 3 files changed, 15 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/base/base.h b/drivers/base/base.h
> > index 430cbefbc97f..aa701878c6e3 100644
> > --- a/drivers/base/base.h
> > +++ b/drivers/base/base.h
> > @@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
> > static inline int driver_match_device(const struct device_driver *drv,
> > struct device *dev)
> > {
> > + device_lock_assert(dev);
> > +
> > return drv->bus->match ? drv->bus->match(dev, drv) : 1;
> > }
> >
> > diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> > index 9eb7771706f0..5cbcf9f5bd6e 100644
> > --- a/drivers/base/bus.c
> > +++ b/drivers/base/bus.c
> > @@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
> > const struct bus_type *bus = bus_get(drv->bus);
> > struct device *dev;
> > int err = -ENODEV;
> > + int ret;
> >
> > dev = bus_find_device_by_name(bus, NULL, buf);
> > - if (dev && driver_match_device(drv, dev)) {
> > - err = device_driver_attach(drv, dev);
> > - if (!err) {
> > - /* success */
> > - err = count;
> > + if (dev) {
> > + device_lock(dev);
> > + ret = driver_match_device(drv, dev);
> > + device_unlock(dev);
> > + if (ret) {
> > + err = device_driver_attach(drv, dev);
> > + if (!err) {
> > + /* success */
> > + err = count;
> > + }
> > }
> > }
> > put_device(dev);
> > diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> > index 349f31bedfa1..e79c732a56e4 100644
> > --- a/drivers/base/dd.c
> > +++ b/drivers/base/dd.c
> > @@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
> > * is an error.
> > */
> >
> > + device_lock(dev);
> > ret = driver_match_device(drv, dev);
> > + device_unlock(dev);
>
> This repeats the pattern above, so maybe add a helper function for it?
Hi Rafael,
The three call sites for driver_match_device() have been stable for
over a decade. With only two sites requiring the lock, and no new
callers anticipated, adding a helper function seems to have limited
value.
Thanks
On Tue, Jan 13, 2026 at 4:56 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
>
> On Tue, Jan 13, 2026 at 11:20 PM Rafael J. Wysocki <rafael@kernel.org> wrote:
> >
> > On Tue, Jan 13, 2026 at 4:05 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
> > >
> > > Currently, driver_match_device() is called from three sites. One site
> > > (__device_attach_driver) holds device_lock(dev), but the other two
> > > (bind_store and __driver_attach) do not. This inconsistency means that
> > > bus match() callbacks are not guaranteed to be called with the lock
> > > held.
> > >
> > > Fix this by holding device_lock(dev) around the driver_match_device()
> > > calls in bind_store() and __driver_attach(). This ensures consistent
> > > locking for all match() callbacks. Also add a lock assertion to
> > > driver_match_device() to enforce this guarantee.
> > >
> > > This consistency also fixes a known race condition. The driver_override
> > > implementation relies on the device_lock, so the missing lock led to the
> > > use-after-free (UAF) reported in Bugzilla for buses using this field.
> > >
> > > Stress testing the two newly locked paths for 24 hours with
> > > CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
> > > and no lockdep warnings.
> > >
> > > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> > > Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
> > > Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> > > ---
> > > v4:
> > > * Remove the misleading comment above device_lock_assert(), and update
> > > subject and commit message to focus on enforcing consistent locking,
> > > as discussed with Danilo Krummrich.
> > > v3:
> > > * Remove redundant locking comments at call sites and add a blank line
> > > after the lock assertion in driver_match_device(), as suggested by Greg KH.
> > > v2:
> > > * Add device_lock_assert() in driver_match_device() to enforce locking
> > > requirement, as suggested by Greg KH.
> > > v1:
> > > * The Bugzilla entry contains full KASAN reports and two PoCs that reliably
> > > reproduce the UAF on both unlocked paths using a standard QEMU setup
> > > (default e1000 device at 0000:00:03.0).
> > > ---
> > > drivers/base/base.h | 2 ++
> > > drivers/base/bus.c | 16 +++++++++++-----
> > > drivers/base/dd.c | 2 ++
> > > 3 files changed, 15 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/drivers/base/base.h b/drivers/base/base.h
> > > index 430cbefbc97f..aa701878c6e3 100644
> > > --- a/drivers/base/base.h
> > > +++ b/drivers/base/base.h
> > > @@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
> > > static inline int driver_match_device(const struct device_driver *drv,
> > > struct device *dev)
> > > {
> > > + device_lock_assert(dev);
> > > +
> > > return drv->bus->match ? drv->bus->match(dev, drv) : 1;
> > > }
> > >
> > > diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> > > index 9eb7771706f0..5cbcf9f5bd6e 100644
> > > --- a/drivers/base/bus.c
> > > +++ b/drivers/base/bus.c
> > > @@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
> > > const struct bus_type *bus = bus_get(drv->bus);
> > > struct device *dev;
> > > int err = -ENODEV;
> > > + int ret;
> > >
> > > dev = bus_find_device_by_name(bus, NULL, buf);
> > > - if (dev && driver_match_device(drv, dev)) {
> > > - err = device_driver_attach(drv, dev);
> > > - if (!err) {
> > > - /* success */
> > > - err = count;
> > > + if (dev) {
> > > + device_lock(dev);
> > > + ret = driver_match_device(drv, dev);
> > > + device_unlock(dev);
> > > + if (ret) {
> > > + err = device_driver_attach(drv, dev);
> > > + if (!err) {
> > > + /* success */
> > > + err = count;
> > > + }
> > > }
> > > }
> > > put_device(dev);
> > > diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> > > index 349f31bedfa1..e79c732a56e4 100644
> > > --- a/drivers/base/dd.c
> > > +++ b/drivers/base/dd.c
> > > @@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
> > > * is an error.
> > > */
> > >
> > > + device_lock(dev);
> > > ret = driver_match_device(drv, dev);
> > > + device_unlock(dev);
> >
> > This repeats the pattern above, so maybe add a helper function for it?
>
> Hi Rafael,
>
> The three call sites for driver_match_device() have been stable for
> over a decade.
Yes, they have, but now it's changing.
> With only two sites requiring the lock, and no new
> callers anticipated, adding a helper function seems to have limited
> value.
It would reduce code duplication. Why is this limited value?
On Wed, Jan 14, 2026 at 12:03 AM Rafael J. Wysocki <rafael@kernel.org> wrote:
>
> On Tue, Jan 13, 2026 at 4:56 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
> >
> > On Tue, Jan 13, 2026 at 11:20 PM Rafael J. Wysocki <rafael@kernel.org> wrote:
> > >
> > > On Tue, Jan 13, 2026 at 4:05 PM Gui-Dong Han <hanguidong02@gmail.com> wrote:
> > > >
> > > > Currently, driver_match_device() is called from three sites. One site
> > > > (__device_attach_driver) holds device_lock(dev), but the other two
> > > > (bind_store and __driver_attach) do not. This inconsistency means that
> > > > bus match() callbacks are not guaranteed to be called with the lock
> > > > held.
> > > >
> > > > Fix this by holding device_lock(dev) around the driver_match_device()
> > > > calls in bind_store() and __driver_attach(). This ensures consistent
> > > > locking for all match() callbacks. Also add a lock assertion to
> > > > driver_match_device() to enforce this guarantee.
> > > >
> > > > This consistency also fixes a known race condition. The driver_override
> > > > implementation relies on the device_lock, so the missing lock led to the
> > > > use-after-free (UAF) reported in Bugzilla for buses using this field.
> > > >
> > > > Stress testing the two newly locked paths for 24 hours with
> > > > CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
> > > > and no lockdep warnings.
> > > >
> > > > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> > > > Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
> > > > Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> > > > ---
> > > > v4:
> > > > * Remove the misleading comment above device_lock_assert(), and update
> > > > subject and commit message to focus on enforcing consistent locking,
> > > > as discussed with Danilo Krummrich.
> > > > v3:
> > > > * Remove redundant locking comments at call sites and add a blank line
> > > > after the lock assertion in driver_match_device(), as suggested by Greg KH.
> > > > v2:
> > > > * Add device_lock_assert() in driver_match_device() to enforce locking
> > > > requirement, as suggested by Greg KH.
> > > > v1:
> > > > * The Bugzilla entry contains full KASAN reports and two PoCs that reliably
> > > > reproduce the UAF on both unlocked paths using a standard QEMU setup
> > > > (default e1000 device at 0000:00:03.0).
> > > > ---
> > > > drivers/base/base.h | 2 ++
> > > > drivers/base/bus.c | 16 +++++++++++-----
> > > > drivers/base/dd.c | 2 ++
> > > > 3 files changed, 15 insertions(+), 5 deletions(-)
> > > >
> > > > diff --git a/drivers/base/base.h b/drivers/base/base.h
> > > > index 430cbefbc97f..aa701878c6e3 100644
> > > > --- a/drivers/base/base.h
> > > > +++ b/drivers/base/base.h
> > > > @@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
> > > > static inline int driver_match_device(const struct device_driver *drv,
> > > > struct device *dev)
> > > > {
> > > > + device_lock_assert(dev);
> > > > +
> > > > return drv->bus->match ? drv->bus->match(dev, drv) : 1;
> > > > }
> > > >
> > > > diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> > > > index 9eb7771706f0..5cbcf9f5bd6e 100644
> > > > --- a/drivers/base/bus.c
> > > > +++ b/drivers/base/bus.c
> > > > @@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
> > > > const struct bus_type *bus = bus_get(drv->bus);
> > > > struct device *dev;
> > > > int err = -ENODEV;
> > > > + int ret;
> > > >
> > > > dev = bus_find_device_by_name(bus, NULL, buf);
> > > > - if (dev && driver_match_device(drv, dev)) {
> > > > - err = device_driver_attach(drv, dev);
> > > > - if (!err) {
> > > > - /* success */
> > > > - err = count;
> > > > + if (dev) {
> > > > + device_lock(dev);
> > > > + ret = driver_match_device(drv, dev);
> > > > + device_unlock(dev);
> > > > + if (ret) {
> > > > + err = device_driver_attach(drv, dev);
> > > > + if (!err) {
> > > > + /* success */
> > > > + err = count;
> > > > + }
> > > > }
> > > > }
> > > > put_device(dev);
> > > > diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> > > > index 349f31bedfa1..e79c732a56e4 100644
> > > > --- a/drivers/base/dd.c
> > > > +++ b/drivers/base/dd.c
> > > > @@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
> > > > * is an error.
> > > > */
> > > >
> > > > + device_lock(dev);
> > > > ret = driver_match_device(drv, dev);
> > > > + device_unlock(dev);
> > >
> > > This repeats the pattern above, so maybe add a helper function for it?
> >
> > Hi Rafael,
> >
> > The three call sites for driver_match_device() have been stable for
> > over a decade.
>
> Yes, they have, but now it's changing.
>
> > With only two sites requiring the lock, and no new
> > callers anticipated, adding a helper function seems to have limited
> > value.
>
> It would reduce code duplication. Why is this limited value?
I see. I have submitted v5 with the helper function
driver_match_device_locked() as suggested.
Thanks.
On Tue Jan 13, 2026 at 4:55 PM CET, Gui-Dong Han wrote: > The three call sites for driver_match_device() have been stable for > over a decade. With only two sites requiring the lock, and no new > callers anticipated, adding a helper function seems to have limited > value. On the other hand, driver_match_device() and driver_match_device_locked() makes things very clear. :)
© 2016 - 2026 Red Hat, Inc.