From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AB18A1061B0F for ; Mon, 30 Mar 2026 16:29:04 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4fkxXH1gC6z2y7r; Tue, 31 Mar 2026 03:29:03 +1100 (AEDT) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=172.105.4.254 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1774888143; cv=none; b=E6cRElZBmw+MOvvRniI5/+wZt9z96tu3H0ZITd7INOrJXVpHL+v8Yt+J6BBincA86mq1WTfbc2qptZzPARzAkWuCEy3cyH8zUa22H458ruxQ5jO4YZ+yy0+gT32LWPXhI39vZ9BNhLNi8J6YolLFW8YHczqKRJW/J8KsSSDLCo739vot7lO1/Z6fQ59R+wd1P6yBBb3dA+ZS03XzzCZtRv4m3dqXdsji63KjuS3g/YoXqtA1T1Y/aLhHcEQ/eukM7paxgj/Mm4mvGrvWYrOlbUGiERLmx9apTunWDs3E1HCARhtuRJsdTnNas1F0mhS6DdAXb2zDpt8xCt9E/Jy1SA== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1774888143; c=relaxed/relaxed; bh=UE/8+ax0UXohGYhnmj94zLq/V9mFDN9c3i4RTAaAc5Y=; h=Mime-Version:Content-Type:Date:Message-Id:Subject:Cc:To:From: References:In-Reply-To; b=OeY658ylrHwDJTcnRyZAHr9VvzfIoVpCZimdoTDyb4HDVC+PQUAIHfLcCQ9nSgaRrWjsLTewKKXRvOt0E7uXhbA3dzgmhDq6ALnP8aRVeRuFduqaGbqpoylK64+nHcE3e1bWyL54i104k2jiVuR4TWp5g8cQ5gx6CdtAZ74LssQLis5AQeuZr7tGN64VtycTlTyhm+pyMiAhnOCM5aD53TPvfGxjQhqUPnLdhCVS/PdIg82E3m7MQqT671I2reQhOLoXHSYaCQBaA1tFxhJlxDTqGWSShbPe5qHQ2gLnWCJVBs1+4SEhIZ2S4RaC1cyMicQxbIe7tEQu6ZuRf59HUQ== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=P/3XWocf; dkim-atps=neutral; spf=pass (client-ip=172.105.4.254; helo=tor.source.kernel.org; envelope-from=dakr@kernel.org; receiver=lists.ozlabs.org) smtp.mailfrom=kernel.org Authentication-Results: lists.ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=kernel.org Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20201202 header.b=P/3XWocf; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=kernel.org (client-ip=172.105.4.254; helo=tor.source.kernel.org; envelope-from=dakr@kernel.org; receiver=lists.ozlabs.org) Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4fkxXF6qqHz2xnl for ; Tue, 31 Mar 2026 03:29:01 +1100 (AEDT) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 3C334600CB; Mon, 30 Mar 2026 16:28:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2732FC4CEF7; Mon, 30 Mar 2026 16:28:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1774888138; bh=HnR3T8HyhR5zh3UidQc9tY5GP+iCNJ+9G4eesNsn66c=; h=Date:Subject:Cc:To:From:References:In-Reply-To:From; b=P/3XWocfTvHDzL/TvgnY90VGL4nSlLd5QBe5hsYLKubBK3nWHOJaPjPq5JQAaRhM8 iAGk5KjaD3ik9GNqL6YSdRdGeXxBgLs24zJtsj3e6fxOpDbi7ZZd8I/d1cyMypX8NE 2XOL2YHA8im3TC/6MZc4CKSvIWYdWZeBHcvNBDXSWRJJuejsAH9jaZzQRbryV+m5kG lnPI2WxSgVXB97c4laa/t/vZgU3QAb4tmja9ypMEFSoxTNm4EFRWFco06IOLdeGzNC AdWvpkXe36xoTq6sFQYDIMUXUgS6vorYizdKVDGjM2rmv+ZiFnuwAzo46ijHVV7DUf PA+6jJae0BAbA== X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Mon, 30 Mar 2026 18:28:48 +0200 Message-Id: Subject: Re: [PATCH 05/12] PCI: use generic driver_override infrastructure Cc: "Russell King" , "Greg Kroah-Hartman" , "Rafael J. Wysocki" , "Ioana Ciornei" , "Nipun Gupta" , "Nikhil Agarwal" , "K. Y. Srinivasan" , "Haiyang Zhang" , "Wei Liu" , "Dexuan Cui" , "Long Li" , "Bjorn Helgaas" , "Armin Wolf" , "Bjorn Andersson" , "Mathieu Poirier" , "Vineeth Vijayan" , "Peter Oberparleiter" , "Heiko Carstens" , "Vasily Gorbik" , "Alexander Gordeev" , "Christian Borntraeger" , "Sven Schnelle" , "Harald Freudenberger" , "Holger Dengler" , "Mark Brown" , "Michael S. Tsirkin" , "Jason Wang" , "Xuan Zhuo" , =?utf-8?q?Eugenio_P=C3=A9rez?= , "Alex Williamson" , "Juergen Gross" , "Stefano Stabellini" , "Oleksandr Tyshchenko" , "Christophe Leroy (CS GROUP)" , , , , , , , , , , , , , , , "Gui-Dong Han" To: "Bjorn Helgaas" From: "Danilo Krummrich" References: <20260324005919.2408620-6-dakr@kernel.org> <20260326180825.GA1330769@bhelgaas> In-Reply-To: <20260326180825.GA1330769@bhelgaas> On Thu Mar 26, 2026 at 7:08 PM CET, Bjorn Helgaas wrote: > On Tue, Mar 24, 2026 at 01:59:09AM +0100, Danilo Krummrich wrote: >> When a driver is probed through __driver_attach(), the bus' match() >> callback is called without the device lock held, thus accessing the >> driver_override field without a lock, which can cause a UAF. >>=20 >> Fix this by using the driver-core driver_override infrastructure taking >> care of proper locking internally. >>=20 >> Note that calling match() from __driver_attach() without the device lock >> held is intentional. [1] >>=20 >> Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@ker= nel.org/ [1] >> Reported-by: Gui-Dong Han >> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=3D220789 >> Fixes: 782a985d7af2 ("PCI: Introduce new device binding path using pci_d= ev.driver_override") >> Signed-off-by: Danilo Krummrich >> --- >> drivers/pci/pci-driver.c | 11 +++++++---- >> drivers/pci/pci-sysfs.c | 28 ---------------------------- >> drivers/pci/probe.c | 1 - >> include/linux/pci.h | 6 ------ > > For the above: > > Acked-by: Bjorn Helgaas > > "driver_override" is mentioned several places in > Documentation/ABI/testing/sysfs-bus-*. I assume this series doesn't > change the behavior documented there? Correct, none of this is altered.