Re: [PATCH 5.10 010/491] bus: fsl-mc: fix use-after-free in driver_override_show()

Gui-Dong Han
2026-04-14T04:16:23Z

On Tue, Apr 14, 2026 at 12:43 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> 5.10-stable review patch. If anyone has any objections, please let me know.

This patch still needs its prerequisite commit 5688f212e98a ("fsl-mc:
Use driver_set_override() instead of open-coding") [1] to be queued
for the 5.10.y and 5.15.y trees.

Without it, driver_override_store() doesn't hold device_lock(), which
means the race remains and can actually trigger a double free. Fedor
and I previously sent reminders about this missing dependency here
[2][3].

Commit 5688f212e98a applies and builds cleanly on both 5.10.y and
5.15.y. Could you please queue it as well?

Thanks.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5688f212e98a
[2] https://lore.kernel.org/stable/CALbr=LY8Shn1Mk2CBu5sCwNeR=Jn7BndH+qvAZGGqWMNoJQePA@mail.gmail.com/
[3] https://lore.kernel.org/stable/20260214220547-5519e7b20a4919ddd81d97c3-pchelkin@ispras/

>
> ------------------
>
> From: Gui-Dong Han <hanguidong02@gmail.com>
>
> [ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
>
> The driver_override_show() function reads the driver_override string
> without holding the device_lock. However, driver_override_store() uses
> driver_set_override(), which modifies and frees the string while holding
> the device_lock.
>
> This can result in a concurrent use-after-free if the string is freed
> by the store function while being read by the show function.
>
> Fix this by holding the device_lock around the read operation.
>
> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>
> Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com
> Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
> index 8f7448da9258d..49eaf5bddd5ad 100644
> --- a/drivers/bus/fsl-mc/fsl-mc-bus.c
> +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
> @@ -194,8 +194,12 @@ static ssize_t driver_override_show(struct device *dev,
> struct device_attribute *attr, char *buf)
> {
> struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
> + ssize_t len;
>
> - return sysfs_emit(buf, "%s\n", mc_dev->driver_override);
> + device_lock(dev);
> + len = sysfs_emit(buf, "%s\n", mc_dev->driver_override);
> + device_unlock(dev);
> + return len;
> }
> static DEVICE_ATTR_RW(driver_override);
>
> --
> 2.51.0
>
>
>