From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 67A6410F3DE2 for ; Sat, 28 Mar 2026 12:10:44 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4fjbv70V1Tz2yfK; Sat, 28 Mar 2026 23:10:43 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip="2600:3c0a:e001:78e:0:1991:8:25" ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1774699843; cv=none; b=bwEqn8TmK/PZRInk0KafDjrEj7R+6gDTiPuBx/lHh5LkmT8FjeO+cFOY+z6P14orC4dP3RrAqxTDWcYnJIcTE39wZbH3TxTJA1AUhaxLL4hTgqcMfsEkz2i3vnTsRbUzYjBgRmPfn/+amoPIv/PhI23zQdiZWqC79AXQjcgMbTAeSlX7Pezo5/nE+ZZdyPkJzFVzd5O4S+2PoIXF2B7VYjxfNXwBJoYlvfXpkn1nZC1sUnkH7NGBMKA/q0AUcnf+EvsEWnOSEE5mr5nangleEbdyczOgahsbBBsX2hU/CEhr3vwcdxNtOSiM8Uy18T+gl3uAfPkU671K6fcg//p3Yg== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1774699843; c=relaxed/relaxed; bh=yOTv8yveft0wjUfc7GYjesXl6P8SwNDlwaPGgO2+5Kc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=N/0nDTbbvLXDX9rzwaVcCQcROY0gYXaiSJz4tuZj3UkLrmfUcTVicMgTXevoR/SIoRxdnc6Edyv1JpIWcBexR7hGlhxxorUgPeJq7aRxQplIYGeUhyzgVwFuBjK5VL93fWV4fITIIeWr3e2/SnaWZbbLrLesxEKft0YoDD+fKl6tO4TS9ynLCaWMWODXAP5rWpQWarb466E4f0yrhvPHus5T80xQgWPev1T9EcdIkkbAtUBM+axkPNgb2HB7dqjUF5JpND/aPtgr+oq278Pxo8jwfFuBqT5gHShlqGti33Vi/ZvaU7ZY7cUi6Zx6oJ5bur3dmrVljyEPNgqbyVicLQ== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=LQI2u2FJ; dkim-atps=neutral; spf=pass (client-ip=2600:3c0a:e001:78e:0:1991:8:25; helo=sea.source.kernel.org; envelope-from=chleroy@kernel.org; receiver=lists.ozlabs.org) smtp.mailfrom=kernel.org Authentication-Results: lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=LQI2u2FJ; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=kernel.org (client-ip=2600:3c0a:e001:78e:0:1991:8:25; helo=sea.source.kernel.org; envelope-from=chleroy@kernel.org; receiver=lists.ozlabs.org) Received: from sea.source.kernel.org (sea.source.kernel.org [IPv6:2600:3c0a:e001:78e:0:1991:8:25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4fjbv61qjWz2xN8 for ; Sat, 28 Mar 2026 23:10:42 +1100 (AEDT) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 52B8543FD2; Sat, 28 Mar 2026 12:10:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 24AC2C4CEF7; Sat, 28 Mar 2026 12:10:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774699839; bh=NTFcZ7aSZIsyP3qPdyEPoyvUbM7dBDc1cogifZf44fs=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=LQI2u2FJrZdfURKcCR9tStL7U7j9JDQoiHCmq72vccMs+ZUBhp+9/TKvL161WNaYt HB6Cn/KW4bpF4LE8szU/Ttp0n1iAeBjvFxI338mQ+OH5v7/aZmAQ9mRmTZhzpLHT8Q 2ij/qw3sRiilAWVo3GAkTfwxr5AaAfiGpMiRoVeACXWF2FpqJdBr1mqCSFspFTpRGG IWAWGn1ScwG3hTcEoF9XWrUzsMNbRCB9m36GDK5FSVbYng9NVfLXXuJIcV7JatH039 EqdHKj9j/+OVngUAIX3Bg6ahCKh6k16Ub4DhdqyNRlVlqKadrI7x9Bvws94pvNi0EJ U/HidD7p2Gw6Q== Message-ID: <4c5e9bad-82f0-4714-99c2-8ccd79a45043@kernel.org> Date: Sat, 28 Mar 2026 13:10:25 +0100 X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 02/12] bus: fsl-mc: use generic driver_override infrastructure To: Ioana Ciornei , Danilo Krummrich Cc: Russell King , Greg Kroah-Hartman , "Rafael J. Wysocki" , Nipun Gupta , Nikhil Agarwal , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Long Li , Bjorn Helgaas , Armin Wolf , Bjorn Andersson , Mathieu Poirier , Vineeth Vijayan , Peter Oberparleiter , Heiko Carstens , Vasily Gorbik , Alexander Gordeev , Christian Borntraeger , Sven Schnelle , Harald Freudenberger , Holger Dengler , Mark Brown , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?UTF-8?Q?Eugenio_P=C4=82=C2=A9rez?= , Alex Williamson , Juergen Gross , Stefano Stabellini , Oleksandr Tyshchenko , linux-kernel@vger.kernel.org, driver-core@lists.linux.dev, linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org, linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org, linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org, linux-s390@vger.kernel.org, linux-spi@vger.kernel.org, virtualization@lists.linux.dev, kvm@vger.kernel.org, xen-devel@lists.xenproject.org, linux-arm-kernel@lists.infradead.org, Gui-Dong Han References: <20260324005919.2408620-1-dakr@kernel.org> <20260324005919.2408620-3-dakr@kernel.org> Content-Language: fr-FR From: "Christophe Leroy (CS GROUP)" In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Le 25/03/2026 à 13:01, Ioana Ciornei a écrit : > On Tue, Mar 24, 2026 at 01:59:06AM +0100, Danilo Krummrich wrote: >> When a driver is probed through __driver_attach(), the bus' match() >> callback is called without the device lock held, thus accessing the >> driver_override field without a lock, which can cause a UAF. >> >> Fix this by using the driver-core driver_override infrastructure taking >> care of proper locking internally. >> >> Note that calling match() from __driver_attach() without the device lock >> held is intentional. [1] >> >> Link: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Fdriver-core%2FDGRGTIRHA62X.3RY09D9SOK77P%40kernel.org%2F&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4b9262ddecdd4ce29f9808de8a66485e%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639100369055903282%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=%2BRfjlUkq7oWV%2F0v2S2B%2BEuxCY%2FLRQv6qHiEWiupd6kc%3D&reserved=0 [1] >> Reported-by: Gui-Dong Han >> Closes: https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.kernel.org%2Fshow_bug.cgi%3Fid%3D220789&data=05%7C02%7Cchristophe.leroy%40csgroup.eu%7C4b9262ddecdd4ce29f9808de8a66485e%7C8b87af7d86474dc78df45f69a2011bb5%7C0%7C0%7C639100369055936232%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=XL1K1ICiygOZnlvDUbQFe192KnLsBQms0HFNGCuyz%2Fw%3D&reserved=0 >> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") >> Signed-off-by: Danilo Krummrich > > Tested-by: Ioana Ciornei > Signed-off-by: Ioana Ciornei > Applied, thanks