[PATCH] Fix race condition in drivers/base/dd.c

[PATCH] Fix race condition in drivers/base/dd.c

[Stefani Seibold]

This patch fix a potential race condition in the driver_bound() function
in the file driver/base/dd.c. 

The broadcast of the BUS_NOTIFY_BOUND_DRIVER notifier should be done
after adding the new device to the driver list. Otherwise notifier
listener will fail if they use functions like usb_find_interface().

The patch is against kernel 2.6.33. Please merge it.

Signed-off-by: Stefani Seibold <stefani@seibold.net>
---
 dd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.33.orig/drivers/base/dd.c	2010-02-24 19:52:17.000000000 +0100
+++ linux-2.6.33/drivers/base/dd.c	2010-02-28 20:25:06.595037275 +0100
@@ -40,11 +40,11 @@ static void driver_bound(struct device *
 	pr_debug("driver: '%s': %s: bound to device '%s'\n", dev_name(dev),
 		 __func__, dev->driver->name);
 
+	klist_add_tail(&dev->p->knode_driver, &dev->driver->p->klist_devices);
+
 	if (dev->bus)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_BOUND_DRIVER, dev);
-
-	klist_add_tail(&dev->p->knode_driver, &dev->driver->p->klist_devices);
 }
 
 static int driver_sysfs_add(struct device *dev)

[PATCH] fix race condition in drivers/base/dd.c

[Stefani Seibold]

This patch fix a potential race condition in the driver_bound() function
in the file driver/base/dd.c. 

The broadcast of the BUS_NOTIFY_BOUND_DRIVER notifier should be done
after adding the new device to the driver list. Otherwise notifier
listener will fail if they use functions like usb_find_interface().

The patch is against kernel 2.6.33. Please merge it.

Signed-off-by: Stefani Seibold <stefani@seibold.net>
---
 dd.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- linux-2.6.33.orig/drivers/base/dd.c	2010-02-24 19:52:17.000000000 +0100
+++ linux-2.6.33/drivers/base/dd.c	2010-02-28 20:25:06.595037275 +0100
@@ -40,11 +40,11 @@ static void driver_bound(struct device *
 	pr_debug("driver: '%s': %s: bound to device '%s'\n", dev_name(dev),
 		 __func__, dev->driver->name);
 
+	klist_add_tail(&dev->p->knode_driver, &dev->driver->p->klist_devices);
+
 	if (dev->bus)
 		blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
 					     BUS_NOTIFY_BOUND_DRIVER, dev);
-
-	klist_add_tail(&dev->p->knode_driver, &dev->driver->p->klist_devices);
 }
 
 static int driver_sysfs_add(struct device *dev)

Re: [PATCH] fix race condition in drivers/base/dd.c

[Greg KH]

On Sat, Mar 06, 2010 at 05:50:14PM +0100, Stefani Seibold wrote:
> This patch fix a potential race condition in the driver_bound() function
> in the file driver/base/dd.c. 
> 
> The broadcast of the BUS_NOTIFY_BOUND_DRIVER notifier should be done
> after adding the new device to the driver list. Otherwise notifier
> listener will fail if they use functions like usb_find_interface().
> 
> The patch is against kernel 2.6.33. Please merge it.

Looks good, are there bugs caused by this problem today that require
this patch to be backported to the -stable kernels?

thanks,

greg k-h

Re: [PATCH] fix race condition in drivers/base/dd.c

[Stefani Seibold]

Am Samstag, den 06.03.2010, 08:57 -0800 schrieb Greg KH:
> On Sat, Mar 06, 2010 at 05:50:14PM +0100, Stefani Seibold wrote:
> > This patch fix a potential race condition in the driver_bound() function
> > in the file driver/base/dd.c. 
> > 
> > The broadcast of the BUS_NOTIFY_BOUND_DRIVER notifier should be done
> > after adding the new device to the driver list. Otherwise notifier
> > listener will fail if they use functions like usb_find_interface().
> > 
> > The patch is against kernel 2.6.33. Please merge it.
> 
> Looks good, are there bugs caused by this problem today that require
> this patch to be backported to the -stable kernels?
> 

No, there is no problem in the stable kernel. There was only a problem
with one of my out of tree driver.

Stefani