Re: [PATCH v2 2/3] driver core: take parent lock on deferred probe

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] driver core: UAF on dev->parent in bus_probe_device_deferred()
--

commit 768aedc18e0fe23bb1bfe38cd117e5b5a7a2fa43
Author: Johan Hovold <johan@kernel.org>

driver core: take parent lock on deferred probe

This commit adds a new bus_probe_device_deferred() helper to handle
deferred probing while ensuring the parent device lock is taken when
required. This ensures USB interfaces are probed correctly with the
parent lock held.

Link: https://lore.kernel.org/20261007131514.1260696-1-mario.peter@leica-geosystems.com

> diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> index d6668fb8ddea5..43d131fd8085d 100644
> --- a/drivers/base/bus.c
> +++ b/drivers/base/bus.c
[ ... ]
> @@ -627,6 +621,26 @@ void bus_probe_device(struct device *dev)
[ ... ]
> +void bus_probe_device_deferred(struct device *dev)
> +{
> +	if (dev->type && dev->type->need_parent_lock)
> +		device_lock(dev->parent);

[Severity: High]
Can this dereference a freed parent pointer?

In drivers/base/dd.c:deferred_probe_work_func(), the code dequeues
the device and keeps it alive with get_device(), but drops the
deferred_probe_mutex.

If a concurrent device teardown (like a parent device unplug) calls
device_del(dev) while the mutex is dropped, device_del() completes
and drops the parent device reference. If that was the last reference,
the parent is freed. Pinning the child via get_device(dev) does not
keep the parent alive after device_del() has completed.

When the worker thread resumes, it calls bus_probe_device_deferred(dev),
which executes device_lock(dev->parent) here before checking dev->p->dead.
Could this lead to a Use-After-Free regression?

Note that the follow-up patch 3/3 does not fix this regression, but
actually propagates the same pattern to __device_attach_async_helper()
via the newly introduced __device_driver_lock(dev, dev->parent).

> +	__bus_probe_device(dev);
> +	if (dev->type && dev->type->need_parent_lock)
> +		device_unlock(dev->parent);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014133109.1392265-1-johan@kernel.org?part=2