[PATCH v1 0/4] driver core, iio: suppress driver_override

[PATCH v1 0/4] driver core, iio: suppress driver_override

[Andy Shevchenko]

Recently Sashiko started reporting the missed NULL check of
spi_get_device_match_data() or device_get_match_data() in SPI drivers
in IIO subsystem. It appears that the way to crash can be made by use
of driver_override sysfs attribute. However, many drivers, that may be
instantiate via ACPI, OF, or, in some cases, user space won't work
without necessary driver data. These are, e.g., most of the drivers
in IIO subsystem. Trying to override the driver for the device that
has no matching entry makes no sense in such cases and might lead to
a crash, when the driver is not prepared for that.  Instead of adding
a NULL check for driver data pointer in each of that drivers, effectively
meaning a dead code for normal functionality, introduce a special
attribute in the struct device_driver to allow drivers just to hide
the attribute for good.

The last two patches are the examples of use and code simplification
at the same time.

I consider getting an Ack from Mark for SPI, and from Jonathan for IIO
and route this via driver core, while providing an immutable branch/tag
for the above mentioned stakeholders.

Note, this doesn't change the state of affairs for some busses that
do not have driver_override flag set while using custom approach.
On a brief look it's the s390 crypto case which may not ever need
the above and hence left untouched.

Andy Shevchenko (4):
  driver core: allow certain drivers prohibit override via sysfs
  spi: Support suppress_override_attrs flag
  iio: imu: inv_mpu6050: Suppress driver_override sysfs attribute
  iio: imu: inv_icm42600: Suppress driver_override sysfs attribute

 Documentation/driver-api/driver-model/binding.rst |  4 ++++
 drivers/base/bus.c                                |  4 ++--
 drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c   |  8 ++------
 drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c         |  3 +--
 drivers/spi/spi.c                                 | 11 +++++++++++
 include/linux/device/driver.h                     |  2 ++
 6 files changed, 22 insertions(+), 10 deletions(-)

-- 
2.50.1

[PATCH v1 1/4] driver core: allow certain drivers prohibit override via sysfs

[Andy Shevchenko]

Many drivers, that may be instantiate via ACPI, OF, or, in some cases,
user space won't work without necessary driver data. These are, e.g.,
most of the drivers in IIO subsystem. Trying to override the driver
for the device that has no matching entry makes no sense in such cases
and might lead to a crash, when the driver is not prepared for that.
Instead of adding a NULL check for driver data pointer in each of that
drivers, effectively meaning a dead code for normal functionality,
introduce a special attribute in the struct device_driver to allow
drivers just to hide the attribute for good.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 Documentation/driver-api/driver-model/binding.rst | 4 ++++
 drivers/base/bus.c                                | 4 ++--
 include/linux/device/driver.h                     | 2 ++
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Documentation/driver-api/driver-model/binding.rst b/Documentation/driver-api/driver-model/binding.rst
index fa0888c2b3b9..19b565a2de86 100644
--- a/Documentation/driver-api/driver-model/binding.rst
+++ b/Documentation/driver-api/driver-model/binding.rst
@@ -147,3 +147,7 @@ Additional helpers are available:
 
 - ``device_set_driver_override()`` - set or clear the override from kernel code.
 - ``device_has_driver_override()`` - check whether an override is set.
+
+Any driver, which bus has ``driver_override`` flag set, can suppress that
+behaviour by setting the ``suppress_override_attrs`` flag in their ``struct
+device_driver``. In this case the sysfs attribute will not show.
diff --git a/drivers/base/bus.c b/drivers/base/bus.c
index d17bd91490ee..16a530b91a00 100644
--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -594,7 +594,7 @@ int bus_add_device(struct device *dev)
 out_subsys:
 	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
 out_override:
-	if (dev->bus->driver_override)
+	if (dev->bus->driver_override && !dev->driver->suppress_override_attrs)
 		device_remove_group(dev, &driver_override_dev_group);
 out_groups:
 	device_remove_groups(dev, sp->bus->dev_groups);
@@ -653,7 +653,7 @@ void bus_remove_device(struct device *dev)
 
 	sysfs_remove_link(&dev->kobj, "subsystem");
 	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
-	if (dev->bus->driver_override)
+	if (dev->bus->driver_override && !dev->driver->suppress_override_attrs)
 		device_remove_group(dev, &driver_override_dev_group);
 	device_remove_groups(dev, dev->bus->dev_groups);
 	if (klist_node_attached(&dev->p->knode_bus))
diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h
index bbc67ec513ed..4b1c1774fd43 100644
--- a/include/linux/device/driver.h
+++ b/include/linux/device/driver.h
@@ -55,6 +55,7 @@ enum probe_type {
  * @owner:	The module owner.
  * @mod_name:	Used for built-in modules.
  * @suppress_bind_attrs: Disables bind/unbind via sysfs.
+ * @suppress_override_attrs: Disables driver_override via sysfs.
  * @probe_type:	Type of the probe (synchronous or asynchronous) to use.
  * @of_match_table: The open firmware table.
  * @acpi_match_table: The ACPI match table.
@@ -103,6 +104,7 @@ struct device_driver {
 	const char		*mod_name;	/* used for built-in modules */
 
 	bool suppress_bind_attrs;	/* disables bind/unbind via sysfs */
+	bool suppress_override_attrs;	/* disables driver_override via sysfs */
 	enum probe_type probe_type;
 
 	const struct of_device_id	*of_match_table;
-- 
2.50.1

Re: [PATCH v1 1/4] driver core: allow certain drivers prohibit override via sysfs

[Danilo Krummrich]

On Fri May 8, 2026 at 11:42 AM CEST, Andy Shevchenko wrote:
> diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> index d17bd91490ee..16a530b91a00 100644
> --- a/drivers/base/bus.c
> +++ b/drivers/base/bus.c
> @@ -594,7 +594,7 @@ int bus_add_device(struct device *dev)
>  out_subsys:
>  	sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
>  out_override:
> -	if (dev->bus->driver_override)
> +	if (dev->bus->driver_override && !dev->driver->suppress_override_attrs)

I think that doesn't work, when bus_add_device() is called no driver is bound to
the device yet, so dev->driver should be NULL.

But more in general, I think this isn't an implementation issue, but a
conceptual issue.

The driver_override attribute is on the device, and indicates whether this
device should be forcefully matched against some specific driver.

Now, if we want to suppress this attribute, we can't really let some driver
define whether is should be suppressed for this device.

Which driver would that be? The one that's already bound?

That said, I think the problem you actually want to resolve is not "suppress the
driver_override attribute", but rather "don't bind this driver through
driver_override".

IOW, this is a match() problem not a sysfs attribute problem.

So, I think the change that we actually want, is this one:

diff --git a/include/linux/device.h b/include/linux/device.h
index d54c86d77764..64bcb46edb97 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -839,9 +839,11 @@ static inline int device_match_driver_override(struct device *dev,
                                               const struct device_driver *drv)
 {
        guard(spinlock)(&dev->driver_override.lock);
-       if (dev->driver_override.name)
-               return !strcmp(dev->driver_override.name, drv->name);
-       return -1;
+       if (!dev->driver_override.name)
+               return -1;
+       if (drv->no_driver_override)
+               return 0;
+       return !strcmp(dev->driver_override.name, drv->name);
 }

 /**
diff --git a/include/linux/device/driver.h b/include/linux/device/driver.h
index bbc67ec513ed..d48cd9822634 100644
--- a/include/linux/device/driver.h
+++ b/include/linux/device/driver.h
@@ -55,6 +55,7 @@ enum probe_type {
  * @owner:     The module owner.
  * @mod_name:  Used for built-in modules.
  * @suppress_bind_attrs: Disables bind/unbind via sysfs.
+ * @no_driver_override: The driver will not be matched via driver_override.
  * @probe_type:        Type of the probe (synchronous or asynchronous) to use.
  * @of_match_table: The open firmware table.
  * @acpi_match_table: The ACPI match table.
@@ -103,6 +104,7 @@ struct device_driver {
        const char              *mod_name;      /* used for built-in modules */

        bool suppress_bind_attrs;       /* disables bind/unbind via sysfs */
+       bool no_driver_override;        /* not matchable via driver_override */
        enum probe_type probe_type;

        const struct of_device_id       *of_match_table;

This should also get us rid of the SPI patch, since SPI already uses
device_match_driver_override() in spi_match_device().

[PATCH v1 2/4] spi: Support suppress_override_attrs flag

[Andy Shevchenko]

Some device driver may want to suppress the driver_override sysfs attribute
by specifying a certain flag in their struct device_driver. Since SPI uses
explicit attribute instantiation, add that support here.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/spi/spi.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 5f57de24b9f7..40e738f8cbb7 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -214,8 +214,19 @@ static struct attribute *spi_dev_attrs[] = {
 	NULL,
 };
 
+static umode_t spi_dev_attr_is_visible(struct kobject *kobj, struct attribute *attr, int i)
+{
+	struct device *dev = kobj_to_dev(kobj);
+
+	if (attr == &dev_attr_driver_override.attr)
+		return dev->driver->suppress_override_attrs ? 0 : attr->mode;
+
+	return attr->mode;
+}
+
 static const struct attribute_group spi_dev_group = {
 	.attrs  = spi_dev_attrs,
+	.is_visible	= spi_dev_attr_is_visible,
 };
 
 static struct attribute *spi_device_statistics_attrs[] = {
-- 
2.50.1

Re: [PATCH v1 2/4] spi: Support suppress_override_attrs flag

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 322 bytes --]

On Fri, May 08, 2026 at 11:42:40AM +0200, Andy Shevchenko wrote:
> Some device driver may want to suppress the driver_override sysfs attribute
> by specifying a certain flag in their struct device_driver. Since SPI uses
> explicit attribute instantiation, add that support here.

Acked-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH v1 2/4] spi: Support suppress_override_attrs flag

[Danilo Krummrich]

On Fri May 8, 2026 at 11:42 AM CEST, Andy Shevchenko wrote:
> diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
> index 5f57de24b9f7..40e738f8cbb7 100644
> --- a/drivers/spi/spi.c
> +++ b/drivers/spi/spi.c
> @@ -214,8 +214,19 @@ static struct attribute *spi_dev_attrs[] = {
>  	NULL,
>  };
>  
> +static umode_t spi_dev_attr_is_visible(struct kobject *kobj, struct attribute *attr, int i)
> +{
> +	struct device *dev = kobj_to_dev(kobj);
> +
> +	if (attr == &dev_attr_driver_override.attr)
> +		return dev->driver->suppress_override_attrs ? 0 : attr->mode;

This should have the same design problem as described in [1].

Also, wouldn't this oops the kernel right away as dev->driver should be NULL?
How did you test this?

[1] https://lore.kernel.org/driver-core/DIDE94YBOOP3.KM9I6J4JIJIY@kernel.org/

> +
> +	return attr->mode;
> +}
> +
>  static const struct attribute_group spi_dev_group = {
>  	.attrs  = spi_dev_attrs,
> +	.is_visible	= spi_dev_attr_is_visible,
>  };
>  
>  static struct attribute *spi_device_statistics_attrs[] = {
> -- 
> 2.50.1

[PATCH v1 3/4] iio: imu: inv_mpu6050: Suppress driver_override sysfs attribute

[Andy Shevchenko]

The driver makes no sense for the devices without associated driver data.
Instead of checking for absence of it, disable driver_override feature
and drop the no more required check.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
index 1f4c62142b60..bdd4ba4e117e 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c
@@ -46,8 +46,6 @@ static int inv_mpu_probe(struct spi_device *spi)
 	} else if ((match = device_get_match_data(&spi->dev))) {
 		chip_type = (uintptr_t)match;
 		name = dev_name(&spi->dev);
-	} else {
-		return -ENODEV;
 	}
 
 	regmap = devm_regmap_init_spi(spi, &inv_mpu_regmap_config);
@@ -175,6 +173,7 @@ static struct spi_driver inv_mpu_driver = {
 		.acpi_match_table = inv_acpi_match,
 		.name	=	"inv-mpu6000-spi",
 		.pm     =       pm_ptr(&inv_mpu_pmops),
+		.suppress_override_attrs = true,
 	},
 };
 
-- 
2.50.1

[PATCH v1 4/4] iio: imu: inv_icm42600: Suppress driver_override sysfs attribute

[Andy Shevchenko]

The driver makes no sense for the devices without associated driver data.
Instead of checking for absence of it, disable driver_override feature
and drop the no more required check.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c
index 13e2e7d38638..cb8c501d86c3 100644
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c
@@ -50,20 +50,15 @@ static int inv_icm42600_spi_bus_setup(struct inv_icm42600_state *st)
 
 static int inv_icm42600_probe(struct spi_device *spi)
 {
-	const void *match;
 	enum inv_icm42600_chip chip;
 	struct regmap *regmap;
 
-	match = device_get_match_data(&spi->dev);
-	if (!match)
-		return -EINVAL;
-	chip = (uintptr_t)match;
-
 	/* use SPI specific regmap */
 	regmap = devm_regmap_init_spi(spi, &inv_icm42600_spi_regmap_config);
 	if (IS_ERR(regmap))
 		return PTR_ERR(regmap);
 
+	chip = (uintptr_t)device_get_match_data(&spi->dev);
 	return inv_icm42600_core_probe(regmap, chip, inv_icm42600_spi_bus_setup);
 }
 
@@ -115,6 +110,7 @@ static struct spi_driver inv_icm42600_driver = {
 		.name = "inv-icm42600-spi",
 		.of_match_table = inv_icm42600_of_matches,
 		.pm = pm_ptr(&inv_icm42600_pm_ops),
+		.suppress_override_attrs = true,
 	},
 	.id_table = inv_icm42600_id,
 	.probe = inv_icm42600_probe,
-- 
2.50.1

Re: [PATCH v1 0/4] driver core, iio: suppress driver_override

[Jonathan Cameron]

On Fri,  8 May 2026 11:42:38 +0200
Andy Shevchenko <andriy.shevchenko@linux.intel.com> wrote:

> Recently Sashiko started reporting the missed NULL check of
> spi_get_device_match_data() or device_get_match_data() in SPI drivers
> in IIO subsystem. It appears that the way to crash can be made by use
> of driver_override sysfs attribute. However, many drivers, that may be
> instantiate via ACPI, OF, or, in some cases, user space won't work
> without necessary driver data. These are, e.g., most of the drivers
> in IIO subsystem. Trying to override the driver for the device that
> has no matching entry makes no sense in such cases and might lead to
> a crash, when the driver is not prepared for that.  Instead of adding
> a NULL check for driver data pointer in each of that drivers, effectively
> meaning a dead code for normal functionality, introduce a special
> attribute in the struct device_driver to allow drivers just to hide
> the attribute for good.
> 
> The last two patches are the examples of use and code simplification
> at the same time.
> 
> I consider getting an Ack from Mark for SPI, and from Jonathan for IIO
> and route this via driver core, while providing an immutable branch/tag
> for the above mentioned stakeholders.

Works for me.

> 
> Note, this doesn't change the state of affairs for some busses that
> do not have driver_override flag set while using custom approach.
> On a brief look it's the s390 crypto case which may not ever need
> the above and hence left untouched.

Excellent!  To me this makes a lot of sense as removing an attribute
that never works for particular drivers is neat and tidy.  I suppose
there is a very small risk that some really strange scripts rely on
that attribute existing but not on it doing anything useful.
If that turns out to be the case we can just make it fail in the callbacks
but definitely not as neat.

One possible concern though based on a typical driver evolution:

1) Driver written - supports only one part, so to match_data involved
   and driver_override is fine.
2) Driver gains support for second device.  match_data added and now
   driver_override is not ok so we set the new flag.  Interface
   disappears and perhaps someone was using it.  Obviously that case
   is broken anyway.

I guess I can make an IIO wide rule that we always set the flag. That
leaves us with a gap though as we have a lot of drivers currently at
step 1 of above that might progress to step 2 over time. I guess we deal
with any reported regressions on a case by case basis.

Ah well - still a step in the right direction even with risks of
regressions.

For all patches
Reviewed-by: Jonathan Cameron <jic23@kernel.org>

Thanks for proposing this Andy

Jonathan

> 
> Andy Shevchenko (4):
>   driver core: allow certain drivers prohibit override via sysfs
>   spi: Support suppress_override_attrs flag
>   iio: imu: inv_mpu6050: Suppress driver_override sysfs attribute
>   iio: imu: inv_icm42600: Suppress driver_override sysfs attribute
> 
>  Documentation/driver-api/driver-model/binding.rst |  4 ++++
>  drivers/base/bus.c                                |  4 ++--
>  drivers/iio/imu/inv_icm42600/inv_icm42600_spi.c   |  8 ++------
>  drivers/iio/imu/inv_mpu6050/inv_mpu_spi.c         |  3 +--
>  drivers/spi/spi.c                                 | 11 +++++++++++
>  include/linux/device/driver.h                     |  2 ++
>  6 files changed, 22 insertions(+), 10 deletions(-)
>