Re: [PATCH 5/9] driver core: do not always lock parent in shutdown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Incorrect condition ordering leads to a potential Use-After-Free of `dev->bus` during device shutdown.
--

commit b894dd7ffd5113988601f8e495c49a29524ecb74
Author: David Jeffery <djeffery@redhat.com>

driver core: do not always lock parent in shutdown

This commit avoids unconditionally locking a parent device during device
shutdown. It introduces __shutdown_one_device and updates
shutdown_one_device to only acquire the parent lock when needed to prevent
races with probe or release operations.

> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 7fe3fa6870a72..05285fae143d3 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
[ ... ]
> @@ -4928,13 +4926,33 @@ static void shutdown_one_device(struct device *dev, struct device *parent)
>  			dev_info(dev, "shutdown\n");
>  		dev->driver->shutdown(dev);
>  	}
> +}
>  
> -	device_unlock(dev);
> -	if (parent)
> +static void shutdown_one_device(struct device *dev)
> +{
> +	struct device *parent;
> +
> +	device_lock(dev);
> +
> +	/* use parent lock if needed to avoid race with probe/release */
> +	if (dev->bus && dev->bus->need_parent_lock && dev->p && !dev->p->dead &&
[Severity: High]
Could this condition ordering lead to a use-after-free during device shutdown?

If a module is unloaded concurrently with system shutdown, device_del() sets
dev->p->dead to true and removes the device from the bus.

Since device_shutdown() already incremented the device's refcount, the
device structure is preserved. However, when the module finishes unloading, it
unregisters the bus and frees the bus_type structure.

Because of left-to-right evaluation in this if statement,
dev->bus->need_parent_lock is accessed before checking !dev->p->dead.

Would checking dev->p && !dev->p->dead before accessing bus properties
prevent reading from the potentially unmapped bus structure?

> +	    (parent = get_device(dev->parent))) {
> +		/* the parent lock needs to be acquired first, so re-lock */
> +		device_unlock(dev);
> +
> +		device_lock(parent);
> +		device_lock(dev);
> +
> +		__shutdown_one_device(dev);
> +		device_unlock(dev);
>  		device_unlock(parent);
> +		put_device(parent);
> +	} else {
> +		__shutdown_one_device(dev);
> +		device_unlock(dev);
> +	}
>  
>  	put_device(dev);
> -	put_device(parent);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902170734.95504-1-djeffery@redhat.com?part=5