From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62B463D8122 for ; Tue, 21 Apr 2026 14:14:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776780887; cv=none; b=RoK1b1F74bWb7rg3f/sMTDxEXG04f7QRCUUaJ8y9MrHIV0aNRGWMg42GMr7teJkYrRIQ4jFXg1MBUza28a93sf6IeP0QK9WILe1NZYom06kvyODWPuG9/06E9/Rp5Tyw/I274WRi9XAq/6geKQw3hE5ncCZgFwCswDHXe1Eidlk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776780887; c=relaxed/simple; bh=IrI/8ulSIurfShGmwYTZgkyp7MravVQ7m6kHMLZIIqg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=aT5sAw1kEFaBLH0SJkQgJ1UTCUDrloaOA74Ec1BkElrEGdyRD7UQSJ8fAK3mP2pawwpm1yqcBl7/eDQtjRtpsJbfKHtv0j+CEfmtKNXrx77DCxHUhsJrlY3v6lHgjSOfJvmwwUUhTqn35bMsvhdTOijvIRKFKYVBXJzPugJacWs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=JQdThZLF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="JQdThZLF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A83EC2BCB0; Tue, 21 Apr 2026 14:14:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1776780886; bh=IrI/8ulSIurfShGmwYTZgkyp7MravVQ7m6kHMLZIIqg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=JQdThZLFEH/0HLtyqF1Q8Z+w8qStxN+iGpIUe8VAapwbQKo+qjznXoNtBLDJYJAxN pF2ckmLnJJv9Dsghurlbt9/nh41MD1cf6bwibf2t5dC4yQHPdw9WiVmimlUxo0KRtn 3e2KDWrsq38NHCApRXSnfQb83HR3gk0GU1PffQgE= Date: Tue, 21 Apr 2026 16:14:44 +0200 From: Greg KH To: l1za0.sec@gmail.com Cc: mcgrof@kernel.org, russ.weight@linux.dev, rafael@kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] drivers: firmware_loader: fix race between sysfs fallback cleanup and device removal Message-ID: <2026042116-matrix-shield-01dd@gregkh> References: <20260421135013.36322-1-l1za0.sec@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260421135013.36322-1-l1za0.sec@gmail.com> On Tue, Apr 21, 2026 at 09:49:57PM +0800, l1za0.sec@gmail.com wrote: > From: Haocheng Yu > > A WARNING in firmware_fallback_sysfs is reported by a modified > Syzkaller-based kernel fuzzing tool that we developed. > > The cause of this issue is a possible race condition between > firmware sysfs fallback cleanup and hot-plug or other device > lifecycle paths. How exactly? This device is under full control of this function, it should "know" if it is registered or not. No other code path should be ever unregistering it. > In this case, fw_load_sysfs_fallback() might run cleanup after the > fallback device has already been removed, i.e., it would execute > device_del(), then dpm_sysfs_remove(), and finally trigger a > warning in sysfs_remove_group(). How exactly does that happen? > This problem can be avoided by adding device_is_registered() > check before calling device_del(). > > Signed-off-by: Haocheng Yu Do you have a reproducer for this issue? > --- > drivers/base/firmware_loader/fallback.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c > index bf68e3947814..a8d8c494f82d 100644 > --- a/drivers/base/firmware_loader/fallback.c > +++ b/drivers/base/firmware_loader/fallback.c > @@ -116,8 +116,9 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout) > } else if (fw_priv->is_paged_buf && !fw_priv->data) > retval = -ENOMEM; > > -out: > - device_del(f_dev); > +out: > + if (device_is_registered(f_dev)) > + device_del(f_dev); Again, this feels wrong. And why was the "out:" line added and added back? That feels like something is odd with the diff? thanks, greg k-h