* [GIT PULL] Driver core changes for 7.0-rc1
@ 2026-02-11 23:04 Danilo Krummrich
2026-02-12 3:58 ` pr-tracker-bot
2026-03-01 7:44 ` Linus Torvalds
0 siblings, 2 replies; 11+ messages in thread
From: Danilo Krummrich @ 2026-02-11 23:04 UTC (permalink / raw)
To: Linus Torvalds
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
Hi Linus,
Please pull these driver-core changes.
All commits have been in linux-next for a couple rounds; no conflicts expected.
In the -rc7 PR [1] I held back a driver-core fix (now included), as it
uncovered potential deadlocks that required a few driver fixes.
You should have received one of those for -rc8 through the gpio tree [2];
another one is included in this PR [3], and the latest one [4] should reach you
via a -fixes PR from the clk tree.
I spent significant effort catching those cases, but they are a bit tricky to
spot. However, all known ones have been addressed.
[1] https://lore.kernel.org/driver-core/DFWVL46MM928.V9LOBRWI8BLZ@kernel.org/
[2] https://lore.kernel.org/all/20260127201725.35883-1-dakr@kernel.org/
[3] https://lore.kernel.org/all/20260121141215.29658-1-dakr@kernel.org/
[4] https://lore.kernel.org/all/20260211142321.55404-1-dakr@kernel.org/
The following changes since commit 63804fed149a6750ffd28610c5c1c98cce6bd377:
Linux 6.19-rc7 (2026-01-25 14:11:24 -0800)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git tags/driver-core-7.0-rc1
for you to fetch changes up to ba268514ea14b44570030e8ed2aef92a38679e85:
rust: devres: fix race condition due to nesting (2026-02-07 01:03:49 +0100)
----------------------------------------------------------------
Driver core changes for 7.0-rc1
- Bus:
- Ensure bus->match() is consistently called with the device lock held
- Improve type safety of bus_find_device_by_acpi_dev()
- Devtmpfs:
- Parse 'devtmpfs.mount=' boot parameter with kstrtoint() instead of
simple_strtoul()
- Avoid sparse warning by making devtmpfs_context_ops static
- IOMMU:
- Do not register the qcom_smmu_tbu_driver in arm_smmu_device_probe()
- MAINTAINERS:
- Add the new driver-core mailing list (driver-core@lists.linux.dev)
to all relevant entries
- Add missing tree location for "FIRMWARE LOADER (request_firmware)"
- Add driver-model documentation to the "DRIVER CORE" entry
- Add missing driver-core maintainers to the "AUXILIARY BUS" entry
- Misc:
- Change return type of attribute_container_register() to void; it has
always been infallible
- Do not export sysfs_change_owner(), sysfs_file_change_owner() and
device_change_owner()
- Move devres_for_each_res() from the public devres header to
drivers/base/base.h
- Do not use a static struct device for the faux bus; allocate it
dynamically
- Revocable:
- Patches for the revocable synchronization primitive have been
scheduled for v7.0-rc1, but have been reverted as they need some
more refinement
- Rust:
- Device:
- Support dev_printk on all device types, not just the core Device
struct; remove now-redundant .as_ref() calls in dev_* print calls
- Devres:
- Introduce an internal reference count in Devres<T> to avoid a
deadlock condition in case of (indirect) nesting
- DMA:
- Allow drivers to tune the maximum DMA segment size via
dma_set_max_seg_size()
- I/O:
- Introduce the concept of generic I/O backends to handle different
kinds of device shared memory through a common interface.
This enables higher-level concepts such as register abstractions,
I/O slices, and field projections to be built generically on top.
In a first step, introduce the Io, IoCapable<T>, and IoKnownSize
trait hierarchy for sharing a common interface supporting offset
validation and bound-checking logic between I/O backends.
- Refactor MMIO to use the common I/O backend infrastructure
- Misc:
- Add __rust_helper annotations to C helpers for inlining into Rust
code
- Use "kernel vertical" style for imports
- Replace kernel::c_str! with C string literals
- Update ARef imports to use sync::aref
- Use pin_init::zeroed() for struct auxiliary_device_id and debugfs
file_operations initialization
- Use LKMM atomic types in debugfs doc-tests
- Various minor comment and documentation fixes
- PCI:
- Implement PCI configuration space accessors using the common I/O
backend infrastructure
- Document pci::Bar device endianness assumptions
- SoC:
- Abstractions for struct soc_device and struct soc_device_attribute
- Sample driver for soc::Device
----------------------------------------------------------------
Alexandre Courbot (1):
rust: io: move MIN_SIZE and io_addr_assert to IoKnownSize
Alice Ryhl (9):
rust: auxiliary: add __rust_helper to helpers
rust: device: add __rust_helper to helpers
rust: dma: add __rust_helper to helpers
rust: io: add __rust_helper to helpers
rust: irq: add __rust_helper to helpers
rust: pci: add __rust_helper to helpers
rust: platform: add __rust_helper to helpers
rust: property: add __rust_helper to helpers
rust: scatterlist: add __rust_helper to helpers
Alok Tiwari (2):
rust: auxiliary: fix remove_callback invariant comment
rust: platform: fix remove_callback invariant comment
Andy Shevchenko (1):
driver core: make bus_find_device_by_acpi_dev() stub prototype aligned
Atharv Dubey (1):
rust: auxiliary: use `pin_init::zeroed()` for device ID
Beata Michalska (1):
rust: dma: allow drivers to tune max segment size
Ben Dooks (1):
devtmpfs: make 'devtmpfs_context_ops' static
Daniel Gomez (1):
driver core: attribute_container: change return type to void
Danilo Krummrich (18):
rust: debugfs: use "kernel vertical" style for imports
Merge tag 'v6.19-rc3' into driver-core-next
rust: auxiliary: use "kernel vertical" style for imports
rust: platform: use "kernel vertical" style for imports
rust: driver-core: use "kernel vertical" style for imports
rust: faux: use "kernel vertical" style for imports
Merge tag 'v6.19-rc5' into driver-core-next
MAINTAINERS: update auxiliary bus entry
MAINTAINERS: driver-core: add driver-model documentation
revocable: fix missing module license and description
iommu/arm-smmu-qcom: do not register driver in probe()
driver-core: move devres_for_each_res() to base.h
MAINTAINERS: Add driver-core mailing list
MAINTAINERS: Add missing T: entry for FIRMWARE LOADER
Merge tag 'v6.19-rc7' into driver-core-next
Merge tag 'driver-core-6.19-rc7-deferred' into driver-core-next
driver core: fix inverted "locked" suffix of driver_match_device()
rust: devres: fix race condition due to nesting
Dirk Behme (2):
samples: rust: pci: Remove some additional `.as_ref()` for `dev_*` print
rust: dma: add missing __rust_helper annotations
FUJITA Tomonori (1):
rust: debugfs: Use kernel Atomic type in docs example
Gary Guo (5):
rust: device: support `dev_printk` on all devices
rust: pci: remove redundant `.as_ref()` for `dev_*` print
rust: samples: driver-core: remove redundant `.as_ref()` for `dev_*` print
rust: samples: dma: remove redundant `.as_ref()` for `dev_*` print
gpu: tyr: remove redundant `.as_ref()` for `dev_*` print
Greg Kroah-Hartman (4):
driver core: faux: stop using static struct device
driver core: disable revocable code from build
sysfs: remove exports of sysfs_*change_owner()
driver core: remove device_change_owner() export
Gui-Dong Han (1):
driver core: enforce device_lock for driver_match_device()
Johan Hovold (3):
Revert "selftests: revocable: Add kselftest cases"
Revert "revocable: Add Kunit test cases"
Revert "revocable: Revocable resource management"
Ke Sun (1):
rust: debugfs: use pin_init::zeroed() for file_operations
Marko Turk (2):
rust: pci: document Bar's endianness conversion
rust: io: remove square brackets from pci::Bar reference
Matthew Maurer (2):
rust: Add soc_device support
rust: Add SoC Driver Sample
Shankari Anand (3):
rust: device: Update ARef and AlwaysRefCounted imports from sync::aref
rust: scatterlist: Update ARef imports to use sync::aref
samples: rust: debugfs: Update ARef imports to use sync::aref
Tamir Duberstein (9):
rust: auxiliary: replace `kernel::c_str!` with C-Strings
rust: device: replace `kernel::c_str!` with C-Strings
rust: platform: replace `kernel::c_str!` with C-Strings
rust: io: replace `kernel::c_str!` with C-Strings
rust: irq: replace `kernel::c_str!` with C-Strings
rust: debugfs: replace `kernel::c_str!` with C-Strings
samples: rust: debugfs: replace `kernel::c_str!` with C-Strings
samples: rust: pci: replace `kernel::c_str!` with C-Strings
samples: rust: faux: replace `kernel::c_str!` with C-Strings
Thorsten Blum (1):
devtmpfs: Replace simple_strtoul with kstrtoint in mount_param
Tzung-Bi Shih (8):
revocable: Revocable resource management
revocable: Add Kunit test cases
selftests: revocable: Add kselftest cases
revocable: Remove redundant synchronize_srcu() call
revocable: Fix races in revocable_alloc() using RCU
revocable: Add KUnit test for provider lifetime races
revocable: fix SRCU index corruption by requiring caller-provided storage
revocable: Add KUnit test for concurrent access
Zhi Wang (5):
rust: devres: style for imports
rust: io: separate generic I/O helpers from MMIO implementation
rust: io: factor out MMIO read/write macros
rust: pci: add config space read/write support
sample: rust: pci: add tests for config space routines
Zijing Zhang (1):
rust: pci: re-export ConfigSpace
MAINTAINERS | 15 +++-
drivers/base/attribute_container.c | 4 +-
drivers/base/base.h | 15 +++-
drivers/base/core.c | 1 -
drivers/base/dd.c | 2 +-
drivers/base/devtmpfs.c | 5 +-
drivers/base/faux.c | 18 +++--
drivers/base/transport_class.c | 8 +-
drivers/gpu/drm/tyr/driver.rs | 2 +-
drivers/gpu/drm/tyr/gpu.rs | 6 +-
drivers/gpu/drm/tyr/regs.rs | 1 +
drivers/gpu/nova-core/gsp/sequencer.rs | 5 +-
drivers/gpu/nova-core/regs/macros.rs | 90 ++++++++++++---------
drivers/gpu/nova-core/vbios.rs | 1 +
drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 ++++
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 +++-
drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 +++++-
drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 ++
drivers/pwm/pwm_th1520.rs | 5 +-
drivers/scsi/scsi_transport_spi.c | 2 +-
fs/sysfs/file.c | 2 -
include/linux/attribute_container.h | 2 +-
include/linux/device/bus.h | 4 +-
include/linux/device/devres.h | 4 -
include/linux/transport_class.h | 6 +-
rust/bindings/bindings_helper.h | 1 +
rust/helpers/auxiliary.c | 6 +-
rust/helpers/device.c | 16 ++--
rust/helpers/dma.c | 31 ++++---
rust/helpers/io.c | 64 ++++++++-------
rust/helpers/irq.c | 6 +-
rust/helpers/pci.c | 23 +++---
rust/helpers/platform.c | 2 +-
rust/helpers/property.c | 2 +-
rust/helpers/scatterlist.c | 12 +--
rust/kernel/auxiliary.rs | 30 ++++---
rust/kernel/debugfs.rs | 86 +++++++++++++-------
rust/kernel/debugfs/callback_adapters.rs | 21 +++--
rust/kernel/debugfs/entry.rs | 14 +++-
rust/kernel/debugfs/file_ops.rs | 43 +++++-----
rust/kernel/debugfs/traits.rs | 43 +++++++---
rust/kernel/device.rs | 32 +++++---
rust/kernel/device/property.rs | 11 +--
rust/kernel/devres.rs | 197 ++++++++++++++++++---------------------------
rust/kernel/dma.rs | 17 ++++
rust/kernel/driver.rs | 12 ++-
rust/kernel/faux.rs | 13 ++-
rust/kernel/io.rs | 479 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------
rust/kernel/io/mem.rs | 33 +++++---
rust/kernel/io/poll.rs | 16 +++-
rust/kernel/irq/request.rs | 6 +-
rust/kernel/lib.rs | 2 +
rust/kernel/pci.rs | 11 ++-
rust/kernel/pci/id.rs | 2 +-
rust/kernel/pci/io.rs | 210 ++++++++++++++++++++++++++++++++++++++++++++++--
rust/kernel/platform.rs | 46 ++++++++---
rust/kernel/scatterlist.rs | 3 +-
rust/kernel/soc.rs | 135 +++++++++++++++++++++++++++++++
samples/rust/Kconfig | 11 +++
samples/rust/Makefile | 1 +
samples/rust/rust_debugfs.rs | 46 +++++++----
samples/rust/rust_debugfs_scoped.rs | 38 +++++----
samples/rust/rust_dma.rs | 13 +--
samples/rust/rust_driver_auxiliary.rs | 14 ++--
samples/rust/rust_driver_faux.rs | 10 ++-
samples/rust/rust_driver_pci.rs | 43 ++++++++--
samples/rust/rust_driver_platform.rs | 42 +++++-----
samples/rust/rust_soc.rs | 79 ++++++++++++++++++
68 files changed, 1604 insertions(+), 573 deletions(-)
create mode 100644 rust/kernel/soc.rs
create mode 100644 samples/rust/rust_soc.rs
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-02-11 23:04 [GIT PULL] Driver core changes for 7.0-rc1 Danilo Krummrich
@ 2026-02-12 3:58 ` pr-tracker-bot
2026-03-01 7:44 ` Linus Torvalds
1 sibling, 0 replies; 11+ messages in thread
From: pr-tracker-bot @ 2026-02-12 3:58 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Linus Torvalds, Greg Kroah-Hartman, Rafael J. Wysocki,
Saravana Kannan, Andrew Morton, driver-core, rust-for-linux,
linux-kernel
The pull request you sent on Thu, 12 Feb 2026 00:04:46 +0100:
> git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git tags/driver-core-7.0-rc1
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/c6e62d002b7f0613f02d8707c80f2a7bd66808a0
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-02-11 23:04 [GIT PULL] Driver core changes for 7.0-rc1 Danilo Krummrich
2026-02-12 3:58 ` pr-tracker-bot
@ 2026-03-01 7:44 ` Linus Torvalds
2026-03-01 7:56 ` Linus Torvalds
` (2 more replies)
1 sibling, 3 replies; 11+ messages in thread
From: Linus Torvalds @ 2026-03-01 7:44 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Wed, 11 Feb 2026 at 15:04, Danilo Krummrich <dakr@kernel.org> wrote:
>
> Driver core changes for 7.0-rc1
>
> - Bus:
> - Ensure bus->match() is consistently called with the device lock held
So I'm coming back to this, because it turns out this sounds like a
horrible mistake in the end.
You document it as being about consistent locking, but it appears this
change is what made the "firewire oops at driver attach" turn an oops
into just a silently dead machine.
In other words, it makes fragile drivers go from "you get an oops" to
something much worse. The oops becomes unrecoverable - with typically
a black screen at boot - because the probe is holding a lock that then
makes everything else come to a grinding halt when the driver fails.
And yes, this obviously only happens for buggy driver and doesn't
matter for _correct_ code, but about half of the kernel code is
drivers, and that half of the kernel code is also the typically the
most badly tested and often questionably implemented half.
No, not all drivers a bad, but there are a lot of drivers, and some of
them have problems.
So if a driver problem causes problems for the whole machine, the
driver core design is bad.
I really think this should be re-thought. Perhaps just reverted
outright. Instead of saying
"This inconsistency means that
bus match() callbacks are not guaranteed to be called with the lock
held"
as if it's automatically a bad thing, just don't depend on the device
match having to be called with a lock held if that lock has this
problem.
It's not clear why anybody should *care* about the lock at driver
attach time, when nothing else can access the device that hasn't been
brought up yet.
Put another way: the downsides seem worse than the upsides.
"Consistency" is not an upside if it causes problems.
Linus
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 7:44 ` Linus Torvalds
@ 2026-03-01 7:56 ` Linus Torvalds
2026-03-01 13:01 ` Gary Guo
2026-03-01 13:04 ` Danilo Krummrich
2 siblings, 0 replies; 11+ messages in thread
From: Linus Torvalds @ 2026-03-01 7:56 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sat, 28 Feb 2026 at 23:44, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> In other words, it makes fragile drivers go from "you get an oops" to
> something much worse. The oops becomes unrecoverable - with typically
> a black screen at boot - because the probe is holding a lock that then
> makes everything else come to a grinding halt when the driver fails.
See this message:
https://lore.kernel.org/all/67f655bb-4d81-4609-b008-68d200255dd2@davidgow.net/
on the interaction with the driver core merge with the firewire oops bug.
In this case we were actually somewhat lucky, in that the hardware is
fairly common, but seldom actually used - a combination that meant tht
wer had several people who caught it fairly quickly and were willing
and able to bisect it. I had the first report the day after -rc1 was
released.
IOW, it could have been *so* much worse. Imagine some random driver
bug on hardware that isn't common and just causes inexplicable boot
failures for the people who see it and are likely using distro
kernels.
Linus
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 7:44 ` Linus Torvalds
2026-03-01 7:56 ` Linus Torvalds
@ 2026-03-01 13:01 ` Gary Guo
2026-03-01 13:04 ` Danilo Krummrich
2 siblings, 0 replies; 11+ messages in thread
From: Gary Guo @ 2026-03-01 13:01 UTC (permalink / raw)
To: Linus Torvalds, Danilo Krummrich
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun Mar 1, 2026 at 7:44 AM GMT, Linus Torvalds wrote:
> On Wed, 11 Feb 2026 at 15:04, Danilo Krummrich <dakr@kernel.org> wrote:
>>
>> Driver core changes for 7.0-rc1
>>
>> - Bus:
>> - Ensure bus->match() is consistently called with the device lock held
>
> So I'm coming back to this, because it turns out this sounds like a
> horrible mistake in the end.
>
> You document it as being about consistent locking, but it appears this
> change is what made the "firewire oops at driver attach" turn an oops
> into just a silently dead machine.
>
> In other words, it makes fragile drivers go from "you get an oops" to
> something much worse. The oops becomes unrecoverable - with typically
> a black screen at boot - because the probe is holding a lock that then
> makes everything else come to a grinding halt when the driver fails.
>
> And yes, this obviously only happens for buggy driver and doesn't
> matter for _correct_ code, but about half of the kernel code is
> drivers, and that half of the kernel code is also the typically the
> most badly tested and often questionably implemented half.
>
> No, not all drivers a bad, but there are a lot of drivers, and some of
> them have problems.
>
> So if a driver problem causes problems for the whole machine, the
> driver core design is bad.
>
> I really think this should be re-thought. Perhaps just reverted
> outright. Instead of saying
>
> "This inconsistency means that
> bus match() callbacks are not guaranteed to be called with the lock
> held"
>
> as if it's automatically a bad thing, just don't depend on the device
> match having to be called with a lock held if that lock has this
> problem.
Note that taking lock on match() fixes a real bug where data race can lead to
use-after-free https://bugzilla.kernel.org/show_bug.cgi?id=220789. It is
mentioned in the patch
https://lore.kernel.org/lkml/20260113162843.12712-1-hanguidong02@gmail.com/.
>
> It's not clear why anybody should *care* about the lock at driver
> attach time, when nothing else can access the device that hasn't been
> brought up yet.
We have always been taking the device lock when probing. This is needed as
obviously you don't want to have two drivers attaching to the same device at the
same time. When probing oops, the device lock is never going to be unlocked
again.
However, before matching starts to take the lock, we're "fine" in a sense that,
everything else keeps working as unless a device is matched and would actually
require probing, the device lock is not touched.
Perhaps what we should do is to defend against drivers oopsing inside probe and
have a mechanism so that device locks are unlocked even when probe oops. Another
option is to have `driver_override` protected by a different lock so match()
takes that lock instead of the device lock.
Best,
Gary
>
> Put another way: the downsides seem worse than the upsides.
> "Consistency" is not an upside if it causes problems.
>
> Linus
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 7:44 ` Linus Torvalds
2026-03-01 7:56 ` Linus Torvalds
2026-03-01 13:01 ` Gary Guo
@ 2026-03-01 13:04 ` Danilo Krummrich
2026-03-01 18:17 ` Linus Torvalds
2026-03-01 18:20 ` Danilo Krummrich
2 siblings, 2 replies; 11+ messages in thread
From: Danilo Krummrich @ 2026-03-01 13:04 UTC (permalink / raw)
To: Linus Torvalds
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun Mar 1, 2026 at 8:44 AM CET, Linus Torvalds wrote:
> So I'm coming back to this, because it turns out this sounds like a
> horrible mistake in the end.
I came to the same conclusion following the discussion around the firewire oops.
> You document it as being about consistent locking
It happens that quite a few busses rely on this, and there is a possible race
condition that can lead to UAF bugs in the context of driver_override.
I think it is rather unlikely to happen though, as it would require a user to
change a device's driver_override field through sysfs while the device is
matched with a driver.
In any case, this can easily be solved with a separate lock.
> In other words, it makes fragile drivers go from "you get an oops" to
> something much worse. The oops becomes unrecoverable - with typically
> a black screen at boot - because the probe is holding a lock that then
> makes everything else come to a grinding halt when the driver fails.
Yes, the problem is that when a device is already present in the system and a
driver is registered on the same bus, we iterate over all devices registered on
this bus to see if one of them matches. If we come across an already bound one
where the corresponding driver crashed while holding the device lock (e.g. in
probe()) we can't make any progress anymore.
Obviously, this is not an issue the other way around, i.e. when the driver is
present in the system first and the device is added subsequently.
> And yes, this obviously only happens for buggy driver and doesn't
> matter for _correct_ code, but about half of the kernel code is
> drivers, and that half of the kernel code is also the typically the
> most badly tested and often questionably implemented half.
I agree, it is a case that will happen regularly, and besides hurting developer
ergonomics, it potentially decreases chances of shutting things down cleanly and
obtaining logs in a production environment as well.
> I really think this should be re-thought. Perhaps just reverted
> outright.
Yes, I agree and in fact I already have a few local changes to move
driver_override to struct device, provide corresponding accessors for busses and
handle locking with a separate lock.
(Technically, the "move driver_override to struct device" part is orthogonal,
but doing it right away results in less (and much cleaner) changes.)
I do not consider those changes to be complicated and risky, but I'm not sure
you want to see those for one of the upcoming -rc releases (probably -rc4/5).
Independently, I can send a revert for -rc3.
Thanks,
Danilo
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 13:04 ` Danilo Krummrich
@ 2026-03-01 18:17 ` Linus Torvalds
2026-03-01 20:21 ` Danilo Krummrich
2026-03-01 18:20 ` Danilo Krummrich
1 sibling, 1 reply; 11+ messages in thread
From: Linus Torvalds @ 2026-03-01 18:17 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun, 1 Mar 2026 at 05:04, Danilo Krummrich <dakr@kernel.org> wrote:
>
> It happens that quite a few busses rely on this, and there is a possible race
> condition that can lead to UAF bugs in the context of driver_override.
>
> I think it is rather unlikely to happen though, as it would require a user to
> change a device's driver_override field through sysfs while the device is
> matched with a driver.
>
> In any case, this can easily be solved with a separate lock.
Yes, if it's literally just about driver_override, please just fix the locking.
Use some really simple local spinlock lock to just copy the string
into a local copy when accessing it - it's not like it's even some
arbitrarily long string afaik (how long can driver names be?)
Don't use a huge sleeping lock that has other semantics for something
trivial like this.
(Or is there some other driver_override thing I'm not aware of?)
Linus
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 13:04 ` Danilo Krummrich
2026-03-01 18:17 ` Linus Torvalds
@ 2026-03-01 18:20 ` Danilo Krummrich
1 sibling, 0 replies; 11+ messages in thread
From: Danilo Krummrich @ 2026-03-01 18:20 UTC (permalink / raw)
To: Linus Torvalds
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun Mar 1, 2026 at 2:04 PM CET, Danilo Krummrich wrote:
> Yes, I agree and in fact I already have a few local changes to move
> driver_override to struct device, provide corresponding accessors for busses and
> handle locking with a separate lock.
>
> (Technically, the "move driver_override to struct device" part is orthogonal,
> but doing it right away results in less (and much cleaner) changes.)
>
> I do not consider those changes to be complicated and risky, but I'm not sure
> you want to see those for one of the upcoming -rc releases (probably -rc4/5).
This is roughly what I have in mind [1] (partially compile and runtime tested).
Given that we agree that the driver_match_device() change should be reverted, it
may make sense to land the first patch in an upcoming -rc, split up the treewide
one, and let subsystems follow-up with those fixes individually.
Please let me know what you prefer.
- Danilo
[1] https://git.kernel.org/pub/scm/linux/kernel/git/dakr/linux.git/log/?h=driver_override
> Independently, I can send a revert for -rc3.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 18:17 ` Linus Torvalds
@ 2026-03-01 20:21 ` Danilo Krummrich
2026-03-01 21:01 ` Linus Torvalds
0 siblings, 1 reply; 11+ messages in thread
From: Danilo Krummrich @ 2026-03-01 20:21 UTC (permalink / raw)
To: Linus Torvalds
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun Mar 1, 2026 at 7:17 PM CET, Linus Torvalds wrote:
> Use some really simple local spinlock lock to just copy the string
> into a local copy when accessing it - it's not like it's even some
> arbitrarily long string afaik (how long can driver names be?)
Yes, that's what my code in [1] already does. Actually, I think we don't even
need a local copy for accessing the string. We should be good with something
like
int device_match_driver_override(struct device *dev,
const struct device_driver *drv)
which internally compares the strings holding the spinlock.
Otherwise, since you asked, the string length is currently limited to
PAGE_SIZE - 1 as it will be copied with sysfs_emit(). But as mentioned, we
shouldn't need a copy anyways.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/dakr/linux.git/log/?h=driver_override
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 20:21 ` Danilo Krummrich
@ 2026-03-01 21:01 ` Linus Torvalds
2026-03-02 19:19 ` Danilo Krummrich
0 siblings, 1 reply; 11+ messages in thread
From: Linus Torvalds @ 2026-03-01 21:01 UTC (permalink / raw)
To: Danilo Krummrich
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun, 1 Mar 2026 at 12:21, Danilo Krummrich <dakr@kernel.org> wrote:
>
> Otherwise, since you asked, the string length is currently limited to
> PAGE_SIZE - 1 as it will be copied with sysfs_emit().
Well, the string length from /proc itself might be long, but do we *care*?
It's only meaningful when it matches a driver name, so anything longer
than the longest driver name is irrelevant - it's not going to match.
So the thing that would matter is the longest actual real driver name.
Aren't those typically just a few bytes (eg "regulator-bus-drv" or
"__typec_altmode_driver" being long ones I find with a bad grep
pattern that might miss millions of other cases)
IOW, it looks like it would be fine to just say "use just a 32-byte
buffer" if a buffer is needed.
Of course, if no buffer is needed that's even better.
Linus
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [GIT PULL] Driver core changes for 7.0-rc1
2026-03-01 21:01 ` Linus Torvalds
@ 2026-03-02 19:19 ` Danilo Krummrich
0 siblings, 0 replies; 11+ messages in thread
From: Danilo Krummrich @ 2026-03-02 19:19 UTC (permalink / raw)
To: Linus Torvalds
Cc: Greg Kroah-Hartman, Rafael J. Wysocki, Saravana Kannan,
Andrew Morton, driver-core, rust-for-linux, linux-kernel
On Sun Mar 1, 2026 at 10:01 PM CET, Linus Torvalds wrote:
> So the thing that would matter is the longest actual real driver name.
> Aren't those typically just a few bytes (eg "regulator-bus-drv" or
> "__typec_altmode_driver" being long ones I find with a bad grep
> pattern that might miss millions of other cases)
Yes, generally they should be pretty short.
OOC, I asked an LLM to figure it out (so take this with the necessary grain of
salt):
Out of ~7,560 unique driver names:
┌────────────┬───────────┐
│ Threshold │ Count │
├────────────┼───────────┤
│ > 32 chars │ 6 (0.08%) │
├────────────┼───────────┤
│ > 48 chars │ 1 (0.01%) │
├────────────┼───────────┤
│ > 64 chars │ 0 │
└────────────┴───────────┘
Length distribution
1-10 chars: 3,513 (46.5%)
11-16 chars: 3,111 (41.1%)
17-24 chars: 880 (11.6%)
25-32 chars: 50 ( 0.7%)
33-49 chars: 6 ( 0.1%)
> IOW, it looks like it would be fine to just say "use just a 32-byte
> buffer" if a buffer is needed.
Assuming the above is roughly correct, you are pretty close. :)
> Of course, if no buffer is needed that's even better.
Yes, I don't think we ever need to obtain a copy other than through
sysfs_emit().
^ permalink raw reply [flat|nested] 11+ messages in thread
end of thread, other threads:[~2026-03-02 19:19 UTC | newest]
Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-11 23:04 [GIT PULL] Driver core changes for 7.0-rc1 Danilo Krummrich
2026-02-12 3:58 ` pr-tracker-bot
2026-03-01 7:44 ` Linus Torvalds
2026-03-01 7:56 ` Linus Torvalds
2026-03-01 13:01 ` Gary Guo
2026-03-01 13:04 ` Danilo Krummrich
2026-03-01 18:17 ` Linus Torvalds
2026-03-01 20:21 ` Danilo Krummrich
2026-03-01 21:01 ` Linus Torvalds
2026-03-02 19:19 ` Danilo Krummrich
2026-03-01 18:20 ` Danilo Krummrich
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox