From: Ioana Ciornei <ioana.ciornei@nxp.com>
To: Danilo Krummrich <dakr@kernel.org>
Cc: "Russell King" <linux@armlinux.org.uk>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Rafael J. Wysocki" <rafael@kernel.org>,
"Nipun Gupta" <nipun.gupta@amd.com>,
"Nikhil Agarwal" <nikhil.agarwal@amd.com>,
"K. Y. Srinivasan" <kys@microsoft.com>,
"Haiyang Zhang" <haiyangz@microsoft.com>,
"Wei Liu" <wei.liu@kernel.org>,
"Dexuan Cui" <decui@microsoft.com>,
"Long Li" <longli@microsoft.com>,
"Bjorn Helgaas" <bhelgaas@google.com>,
"Armin Wolf" <W_Armin@gmx.de>,
"Bjorn Andersson" <andersson@kernel.org>,
"Mathieu Poirier" <mathieu.poirier@linaro.org>,
"Vineeth Vijayan" <vneethv@linux.ibm.com>,
"Peter Oberparleiter" <oberpar@linux.ibm.com>,
"Heiko Carstens" <hca@linux.ibm.com>,
"Vasily Gorbik" <gor@linux.ibm.com>,
"Alexander Gordeev" <agordeev@linux.ibm.com>,
"Christian Borntraeger" <borntraeger@linux.ibm.com>,
"Sven Schnelle" <svens@linux.ibm.com>,
"Harald Freudenberger" <freude@linux.ibm.com>,
"Holger Dengler" <dengler@linux.ibm.com>,
"Mark Brown" <broonie@kernel.org>,
"Michael S. Tsirkin" <mst@redhat.com>,
"Jason Wang" <jasowang@redhat.com>,
"Xuan Zhuo" <xuanzhuo@linux.alibaba.com>,
"Eugenio PĂ©rez" <eperezma@redhat.com>,
"Alex Williamson" <alex@shazbot.org>,
"Juergen Gross" <jgross@suse.com>,
"Stefano Stabellini" <sstabellini@kernel.org>,
"Oleksandr Tyshchenko" <oleksandr_tyshchenko@epam.com>,
"Christophe Leroy (CS GROUP)" <chleroy@kernel.org>,
linux-kernel@vger.kernel.org, driver-core@lists.linux.dev,
linuxppc-dev@lists.ozlabs.org, linux-hyperv@vger.kernel.org,
linux-pci@vger.kernel.org, platform-driver-x86@vger.kernel.org,
linux-arm-msm@vger.kernel.org, linux-remoteproc@vger.kernel.org,
linux-s390@vger.kernel.org, linux-spi@vger.kernel.org,
virtualization@lists.linux.dev, kvm@vger.kernel.org,
xen-devel@lists.xenproject.org,
linux-arm-kernel@lists.infradead.org,
"Gui-Dong Han" <hanguidong02@gmail.com>
Subject: Re: [PATCH 02/12] bus: fsl-mc: use generic driver_override infrastructure
Date: Wed, 25 Mar 2026 14:01:29 +0200 [thread overview]
Message-ID: <cvcetxkxjq2tz6n2vsofhyzove3qdi2e4r6rq6yxou3joejk2h@rmt5ygav7ssu> (raw)
In-Reply-To: <20260324005919.2408620-3-dakr@kernel.org>
On Tue, Mar 24, 2026 at 01:59:06AM +0100, Danilo Krummrich wrote:
> When a driver is probed through __driver_attach(), the bus' match()
> callback is called without the device lock held, thus accessing the
> driver_override field without a lock, which can cause a UAF.
>
> Fix this by using the driver-core driver_override infrastructure taking
> care of proper locking internally.
>
> Note that calling match() from __driver_attach() without the device lock
> held is intentional. [1]
>
> Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
> Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
> Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
next prev parent reply other threads:[~2026-03-25 12:01 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 0:59 [PATCH 00/12] treewide: Convert buses to use generic driver_override Danilo Krummrich
2026-03-24 0:59 ` [PATCH 01/12] amba: use generic driver_override infrastructure Danilo Krummrich
2026-03-24 0:59 ` [PATCH 02/12] bus: fsl-mc: " Danilo Krummrich
2026-03-25 12:01 ` Ioana Ciornei [this message]
2026-03-24 0:59 ` [PATCH 03/12] cdx: " Danilo Krummrich
2026-03-24 0:59 ` [PATCH 04/12] hv: vmbus: " Danilo Krummrich
2026-03-25 17:28 ` Michael Kelley
2026-03-24 0:59 ` [PATCH 05/12] PCI: " Danilo Krummrich
2026-03-25 3:08 ` Gui-Dong Han
2026-03-24 0:59 ` [PATCH 06/12] platform/wmi: " Danilo Krummrich
2026-03-24 19:41 ` Armin Wolf
2026-03-24 0:59 ` [PATCH 07/12] rpmsg: " Danilo Krummrich
2026-03-25 15:49 ` Mathieu Poirier
2026-03-24 0:59 ` [PATCH 08/12] vdpa: " Danilo Krummrich
2026-03-25 10:17 ` Eugenio Perez Martin
2026-03-24 0:59 ` [PATCH 09/12] s390/cio: " Danilo Krummrich
2026-03-26 9:43 ` Vineeth Vijayan
2026-03-24 0:59 ` [PATCH 10/12] s390/ap: " Danilo Krummrich
2026-03-24 12:41 ` Harald Freudenberger
2026-03-24 12:58 ` Holger Dengler
2026-03-24 0:59 ` [PATCH 11/12] spi: " Danilo Krummrich
2026-03-24 0:59 ` [PATCH 12/12] driver core: remove driver_set_override() Danilo Krummrich
2026-03-24 8:09 ` Greg Kroah-Hartman
2026-03-24 15:00 ` (subset) [PATCH 00/12] treewide: Convert buses to use generic driver_override Mark Brown
2026-03-25 9:29 ` Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cvcetxkxjq2tz6n2vsofhyzove3qdi2e4r6rq6yxou3joejk2h@rmt5ygav7ssu \
--to=ioana.ciornei@nxp.com \
--cc=W_Armin@gmx.de \
--cc=agordeev@linux.ibm.com \
--cc=alex@shazbot.org \
--cc=andersson@kernel.org \
--cc=bhelgaas@google.com \
--cc=borntraeger@linux.ibm.com \
--cc=broonie@kernel.org \
--cc=chleroy@kernel.org \
--cc=dakr@kernel.org \
--cc=decui@microsoft.com \
--cc=dengler@linux.ibm.com \
--cc=driver-core@lists.linux.dev \
--cc=eperezma@redhat.com \
--cc=freude@linux.ibm.com \
--cc=gor@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=haiyangz@microsoft.com \
--cc=hanguidong02@gmail.com \
--cc=hca@linux.ibm.com \
--cc=jasowang@redhat.com \
--cc=jgross@suse.com \
--cc=kvm@vger.kernel.org \
--cc=kys@microsoft.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-remoteproc@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=longli@microsoft.com \
--cc=mathieu.poirier@linaro.org \
--cc=mst@redhat.com \
--cc=nikhil.agarwal@amd.com \
--cc=nipun.gupta@amd.com \
--cc=oberpar@linux.ibm.com \
--cc=oleksandr_tyshchenko@epam.com \
--cc=platform-driver-x86@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=sstabellini@kernel.org \
--cc=svens@linux.ibm.com \
--cc=virtualization@lists.linux.dev \
--cc=vneethv@linux.ibm.com \
--cc=wei.liu@kernel.org \
--cc=xen-devel@lists.xenproject.org \
--cc=xuanzhuo@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox