[PATCH v2 0/5] treewide: Convert buses to use generic driver_override

Danilo Krummrich
2026-05-05T13:39:48Z

This is the follow-up of the driver_override generalization in [1], converting
the remaining 4 busses and removing the now-unused driver_set_override() helper.

All of them are prone to the potential UAF described in [2], caused by accessing
the driver_override field from their corresponding match() callback.

In order to address this, the generalized driver_override field in struct device
is protected with a spinlock. The driver-core provides accessors, such as
device_match_driver_override(), device_has_driver_override() and
device_set_driver_override(), which all ensure proper locking internally.

Additionally, the driver-core provides a driver_override flag in struct
bus_type, which, once enabled, automatically registers generic sysfs callbacks,
allowing userspace to modify the driver_override field.

This series is based on v7.1-rc1 with no additional dependencies, hence those
patches can be picked up by subsystems individually.

[1] https://lore.kernel.org/driver-core/20260303115720.48783-1-dakr@kernel.org/
[2] https://bugzilla.kernel.org/show_bug.cgi?id=220789
[3] https://gitlab.com/driverctl/driverctl/-/blob/0.121/driverctl?ref_type=tags#L99

Changes in v2:
- Rebase on v7.1-rc1
- Drop already merged patches
- vmbus documentation changes as requested by Michael

Danilo Krummrich (5):
amba: use generic driver_override infrastructure
cdx: use generic driver_override infrastructure
Drivers: hv: vmbus: use generic driver_override infrastructure
rpmsg: use generic driver_override infrastructure
driver core: remove driver_set_override()

drivers/amba/bus.c | 37 +++------------
drivers/base/driver.c | 75 -------------------------------
drivers/cdx/cdx.c | 40 +++--------------
drivers/hv/vmbus_drv.c | 43 +++++-------------
drivers/rpmsg/qcom_glink_native.c | 2 -
drivers/rpmsg/rpmsg_core.c | 43 +++---------------
drivers/rpmsg/virtio_rpmsg_bus.c | 1 -
include/linux/amba/bus.h | 5 ---
include/linux/cdx/cdx_bus.h | 4 --
include/linux/device/driver.h | 2 -
include/linux/hyperv.h | 5 ---
include/linux/rpmsg.h | 4 --
12 files changed, 28 insertions(+), 233 deletions(-)

base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
--
2.54.0