From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3E603FFADE; Tue, 31 Mar 2026 15:02:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.9 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774969379; cv=none; b=gKFKM2U7cL0wVfHr1VACyM8vJXJeBNWR0ZQFXbxzdKMMf4Iopv/ZMJ5yVIOuB08tonWaEWbuX82OHvbDOiVb8VwqKh/pE0eaSnNAnxl/URo2y9b4Fj6S0IrN+v5Mf7oikXyxdlVFZeJrWhNCu10NVwWo+3JzZS3SbgUE/QFDENQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774969379; c=relaxed/simple; bh=lKc0nR0+3UMuWZyWz6l9MjXgdkdLagd8O+NJe9KaxV4=; h=From:Date:To:cc:Subject:In-Reply-To:Message-ID:References: MIME-Version:Content-Type; b=Lx/7ecs92D1hikmR3vFhX7VxOxmrB/fyYBABeF61Dyom9t4LoeVm0IC4wiQKz+lkFIAV+lo9+FQQ68yAzj1rzFFDc6dVcWjM9+NxK7go1pQ0AeFjepxtkCARijy/qLXP5exlskO9v/DkEjleguXHfVQRUPnNGpXqA3kwykWBzaA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=KglO/3Mo; arc=none smtp.client-ip=192.198.163.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="KglO/3Mo" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1774969378; x=1806505378; h=from:date:to:cc:subject:in-reply-to:message-id: references:mime-version; bh=lKc0nR0+3UMuWZyWz6l9MjXgdkdLagd8O+NJe9KaxV4=; b=KglO/3MoKB03HCMY9nz1ITGz+Qa37xd8SnZOvQMODqf0t8PNlmVMg/tp QHBLVF698m5kmyc4YsjSCJpM0zmzjqFET/6ucwoyhUGqtoxAGxL0CWpug DZNg95KYp69URRRBJxX5PN+iPe44nv0wCkh+AtZc0SeY7atamrggNfKBS we35ntCa8D8eT48w1TOuvPHzKmMY7J/9lpAlEbYdUYYHXpEcniUTfk8Lw zZvCqmTAbmHxLG1uAAb6nCdkFFyHk/zMWLKOZyRLS4oNfMAmUUQ7sX8UU luF3N0D/ouUGbSvHlmWfS4QOt6bdhmrlIQ9+fBTUCoZQWGmXuDZ3j/dYa w==; X-CSE-ConnectionGUID: lI8GtGyzTBCrHEwicmhDjg== X-CSE-MsgGUID: DJRoOitSTMCDj6sHxM/BrQ== X-IronPort-AV: E=McAfee;i="6800,10657,11745"; a="86682260" X-IronPort-AV: E=Sophos;i="6.23,152,1770624000"; d="scan'208";a="86682260" Received: from fmviesa006.fm.intel.com ([10.60.135.146]) by fmvoesa103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Mar 2026 08:02:53 -0700 X-CSE-ConnectionGUID: JHiKH3CWRemnPBHhcWS24A== X-CSE-MsgGUID: Gcx1iYgWQJaJHg3SKbkrBg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,152,1770624000"; d="scan'208";a="221527611" Received: from ijarvine-mobl1.ger.corp.intel.com (HELO localhost) ([10.245.244.6]) by fmviesa006-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Mar 2026 08:02:37 -0700 From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= Date: Tue, 31 Mar 2026 18:02:33 +0300 (EEST) To: Danilo Krummrich cc: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Ioana Ciornei , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?ISO-8859-15?Q?Eugenio_P=E9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , "Christophe Leroy (CS GROUP)" , LKML , driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Gui-Dong Han Subject: Re: [PATCH 06/12] platform/wmi: use generic driver_override infrastructure In-Reply-To: <20260324005919.2408620-7-dakr@kernel.org> Message-ID: References: <20260324005919.2408620-1-dakr@kernel.org> <20260324005919.2408620-7-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-spi@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII On Tue, 24 Mar 2026, Danilo Krummrich wrote: > When a driver is probed through __driver_attach(), the bus' match() > callback is called without the device lock held, thus accessing the > driver_override field without a lock, which can cause a UAF. > > Fix this by using the driver-core driver_override infrastructure taking > care of proper locking internally. > > Note that calling match() from __driver_attach() without the device lock > held is intentional. [1] > > Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] > Reported-by: Gui-Dong Han > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 > Fixes: 12046f8c77e0 ("platform/x86: wmi: Add driver_override support") > Signed-off-by: Danilo Krummrich > --- > drivers/platform/wmi/core.c | 36 +++++------------------------------- > include/linux/wmi.h | 4 ---- > 2 files changed, 5 insertions(+), 35 deletions(-) > > diff --git a/drivers/platform/wmi/core.c b/drivers/platform/wmi/core.c > index b8e6b9a421c6..750e3619724e 100644 > --- a/drivers/platform/wmi/core.c > +++ b/drivers/platform/wmi/core.c > @@ -842,39 +842,11 @@ static ssize_t expensive_show(struct device *dev, > } > static DEVICE_ATTR_RO(expensive); > > -static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr, > - char *buf) > -{ > - struct wmi_device *wdev = to_wmi_device(dev); > - ssize_t ret; > - > - device_lock(dev); > - ret = sysfs_emit(buf, "%s\n", wdev->driver_override); > - device_unlock(dev); > - > - return ret; > -} > - > -static ssize_t driver_override_store(struct device *dev, struct device_attribute *attr, > - const char *buf, size_t count) > -{ > - struct wmi_device *wdev = to_wmi_device(dev); > - int ret; > - > - ret = driver_set_override(dev, &wdev->driver_override, buf, count); > - if (ret < 0) > - return ret; > - > - return count; > -} > -static DEVICE_ATTR_RW(driver_override); > - > static struct attribute *wmi_attrs[] = { > &dev_attr_modalias.attr, > &dev_attr_guid.attr, > &dev_attr_instance_count.attr, > &dev_attr_expensive.attr, > - &dev_attr_driver_override.attr, > NULL > }; > ATTRIBUTE_GROUPS(wmi); > @@ -943,7 +915,6 @@ static void wmi_dev_release(struct device *dev) > { > struct wmi_block *wblock = dev_to_wblock(dev); > > - kfree(wblock->dev.driver_override); > kfree(wblock); > } > > @@ -952,10 +923,12 @@ static int wmi_dev_match(struct device *dev, const struct device_driver *driver) > const struct wmi_driver *wmi_driver = to_wmi_driver(driver); > struct wmi_block *wblock = dev_to_wblock(dev); > const struct wmi_device_id *id = wmi_driver->id_table; > + int ret; > > /* When driver_override is set, only bind to the matching driver */ > - if (wblock->dev.driver_override) > - return !strcmp(wblock->dev.driver_override, driver->name); > + ret = device_match_driver_override(dev, driver); > + if (ret >= 0) > + return ret; > > if (id == NULL) > return 0; > @@ -1076,6 +1049,7 @@ static struct class wmi_bus_class = { > static const struct bus_type wmi_bus_type = { > .name = "wmi", > .dev_groups = wmi_groups, > + .driver_override = true, > .match = wmi_dev_match, > .uevent = wmi_dev_uevent, > .probe = wmi_dev_probe, > diff --git a/include/linux/wmi.h b/include/linux/wmi.h > index 75cb0c7cfe57..14fb644e1701 100644 > --- a/include/linux/wmi.h > +++ b/include/linux/wmi.h > @@ -18,16 +18,12 @@ > * struct wmi_device - WMI device structure > * @dev: Device associated with this WMI device > * @setable: True for devices implementing the Set Control Method > - * @driver_override: Driver name to force a match; do not set directly, > - * because core frees it; use driver_set_override() to > - * set or clear it. > * > * This represents WMI devices discovered by the WMI driver core. > */ > struct wmi_device { > struct device dev; > bool setable; > - const char *driver_override; > }; > > /** > Hi, I tried applying this to platform-drivers tree but it failed to compile so I ended up dropping the changed. -- i.