This is the follow-up of the driver_override generalization in [1], converting
the remaining 4 busses and removing the now-unused driver_set_override() helper.

All of them are prone to the potential UAF described in [2], caused by accessing
the driver_override field from their corresponding match() callback.

In order to address this, the generalized driver_override field in struct device
is protected with a spinlock. The driver-core provides accessors, such as
device_match_driver_override(), device_has_driver_override() and
device_set_driver_override(), which all ensure proper locking internally.

Additionally, the driver-core provides a driver_override flag in struct
bus_type, which, once enabled, automatically registers generic sysfs callbacks,
allowing userspace to modify the driver_override field.

This series is based on v7.1-rc1 with no additional dependencies, hence those
patches can be picked up by subsystems individually.

[1] https://lore.kernel.org/driver-core/20260303115720.48783-1-dakr@kernel.org/
[2] https://bugzilla.kernel.org/show_bug.cgi?id=220789
[3] https://gitlab.com/driverctl/driverctl/-/blob/0.121/driverctl?ref_type=tags#L99

Changes in v2:
  - Rebase on v7.1-rc1
  - Drop already merged patches
  - vmbus documentation changes as requested by Michael

Danilo Krummrich (5):
  amba: use generic driver_override infrastructure
  cdx: use generic driver_override infrastructure
  Drivers: hv: vmbus: use generic driver_override infrastructure
  rpmsg: use generic driver_override infrastructure
  driver core: remove driver_set_override()

 drivers/amba/bus.c                | 37 +++------------
 drivers/base/driver.c             | 75 -------------------------------
 drivers/cdx/cdx.c                 | 40 +++--------------
 drivers/hv/vmbus_drv.c            | 43 +++++-------------
 drivers/rpmsg/qcom_glink_native.c |  2 -
 drivers/rpmsg/rpmsg_core.c        | 43 +++---------------
 drivers/rpmsg/virtio_rpmsg_bus.c  |  1 -
 include/linux/amba/bus.h          |  5 ---
 include/linux/cdx/cdx_bus.h       |  4 --
 include/linux/device/driver.h     |  2 -
 include/linux/hyperv.h            |  5 ---
 include/linux/rpmsg.h             |  4 --
 12 files changed, 28 insertions(+), 233 deletions(-)


base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
-- 
2.54.0

On Tue,  5 May 2026 15:37:20 +0200, Danilo Krummrich wrote:
> [PATCH v2 0/5] treewide: Convert buses to use generic driver_override

Applied, thanks!

  Branch: driver-core-testing
  Tree:   git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git

[1/5] amba: use generic driver_override infrastructure
      commit: 1947229f5f2a
[2/5] cdx: use generic driver_override infrastructure
      commit: d541aa1897f6
[3/5] Drivers: hv: vmbus: use generic driver_override infrastructure
      commit: 331d8900121a
[4/5] rpmsg: use generic driver_override infrastructure
      commit: 55ced13c4292
[5/5] driver core: remove driver_set_override()
      commit: 46def663dd34

The patches will appear in the next linux-next integration (typically within 24
hours on weekdays).

The patches are in the driver-core-testing branch and will be promoted to
driver-core-next after validation.

On Tue, May 05, 2026 at 03:37:20PM +0200, Danilo Krummrich wrote:
> This is the follow-up of the driver_override generalization in [1], converting
> the remaining 4 busses and removing the now-unused driver_set_override() helper.
> 
> All of them are prone to the potential UAF described in [2], caused by accessing
> the driver_override field from their corresponding match() callback.
> 
> In order to address this, the generalized driver_override field in struct device
> is protected with a spinlock. The driver-core provides accessors, such as
> device_match_driver_override(), device_has_driver_override() and
> device_set_driver_override(), which all ensure proper locking internally.
> 
> Additionally, the driver-core provides a driver_override flag in struct
> bus_type, which, once enabled, automatically registers generic sysfs callbacks,
> allowing userspace to modify the driver_override field.
> 
> This series is based on v7.1-rc1 with no additional dependencies, hence those
> patches can be picked up by subsystems individually.
> 
> [1] https://lore.kernel.org/driver-core/20260303115720.48783-1-dakr@kernel.org/
> [2] https://bugzilla.kernel.org/show_bug.cgi?id=220789
> [3] https://gitlab.com/driverctl/driverctl/-/blob/0.121/driverctl?ref_type=tags#L99


Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

On Tue May 5, 2026 at 3:37 PM CEST, Danilo Krummrich wrote:
> This series is based on v7.1-rc1 with no additional dependencies, hence those
> patches can be picked up by subsystems individually.

Gentle ping on this one; I can alternatively also take those patches through the
driver-core tree if you prefer.

Thanks,
Danilo

On Mon May 11, 2026 at 8:02 PM CEST, Danilo Krummrich wrote:
> On Tue May 5, 2026 at 3:37 PM CEST, Danilo Krummrich wrote:
>> This series is based on v7.1-rc1 with no additional dependencies, hence those
>> patches can be picked up by subsystems individually.
>
> Gentle ping on this one; I can alternatively also take those patches through the
> driver-core tree if you prefer.

Since the remaining patches of this series have been out since v7.0-rc5 without
any objections, I'm planning to pick it up through the driver-core tree for
v7.2-rc1.

Please let me know if there are any concerns or whether you prefer to take
individual patches through your own tree.

Thanks,
Danilo