kernel/linux.git/drivers/base/bus.c, branch v6.6.132

Revert "driver core: enforce device_lock for driver_match_device()"

2026-02-16T16:08:02+00:00

This reverts commit adc1796eced46b48e23ec200a219d635f33a38ee which is commit dc23806a7c47ec5f1293aba407fb69519f976ee0 upstream. It causes boot regressions on some systems as all of the "fixes" for drivers are not properly backported yet. Once that is completed, only then can this be applied, if really necessary given the potential for explosions, perhaps we might want to wait a few -rc releases first... Cc: Danilo Krummrich Cc: Rafael J. Wysocki (Intel) Cc: Danilo Krummrich Cc: Gui-Dong Han Cc: Qiu-ji Chen Reported-by: Mark Brown Link: https://lore.kernel.org/r/7dfd0e63-a725-4fac-b2a0-f2e621d99d1b@sirena.org.uk Signed-off-by: Greg Kroah-Hartman

driver core: enforce device_lock for driver_match_device()

2026-02-16T09:17:47+00:00

commit dc23806a7c47ec5f1293aba407fb69519f976ee0 upstream. Currently, driver_match_device() is called from three sites. One site (__device_attach_driver) holds device_lock(dev), but the other two (bind_store and __driver_attach) do not. This inconsistency means that bus match() callbacks are not guaranteed to be called with the lock held. Fix this by introducing driver_match_device_locked(), which guarantees holding the device lock using a scoped guard. Replace the unlocked calls in bind_store() and __driver_attach() with this new helper. Also add a lock assertion to driver_match_device() to enforce this guarantee. This consistency also fixes a known race condition. The driver_override implementation relies on the device_lock, so the missing lock led to the use-after-free (UAF) reported in Bugzilla for buses using this field. Stress testing the two newly locked paths for 24 hours with CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence and no lockdep warnings. Cc: stable@vger.kernel.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Suggested-by: Qiu-ji Chen Signed-off-by: Gui-Dong Han Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock") Reviewed-by: Danilo Krummrich Reviewed-by: Greg Kroah-Hartman Reviewed-by: Rafael J. Wysocki (Intel) Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com Signed-off-by: Danilo Krummrich Signed-off-by: Greg Kroah-Hartman

driver core: fix potential NULL pointer dereference in dev_uevent()

2025-05-02T05:51:03+00:00

commit 18daa52418e7e4629ed1703b64777294209d2622 upstream. If userspace reads "uevent" device attribute at the same time as another threads unbinds the device from its driver, change to dev->driver from a valid pointer to NULL may result in crash. Fix this by using READ_ONCE() when fetching the pointer, and take bus' drivers klist lock to make sure driver instance will not disappear while we access it. Use WRITE_ONCE() when setting the driver pointer to ensure there is no tearing. Signed-off-by: Dmitry Torokhov Reviewed-by: Masami Hiramatsu (Google) Link: https://lore.kernel.org/r/20250311052417.1846985-3-dmitry.torokhov@gmail.com Signed-off-by: Greg Kroah-Hartman

driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute

2024-10-17T13:24:21+00:00

[ Upstream commit c0fd973c108cdc22a384854bc4b3e288a9717bb2 ] Return -EIO instead of 0 for below erroneous bus attribute operations: - read a bus attribute without show(). - write a bus attribute without store(). Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20240724-bus_fix-v2-1-5adbafc698fb@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

driver core: bus: Fix double free in driver API bus_register()

2024-10-17T13:24:21+00:00

[ Upstream commit bfa54a793ba77ef696755b66f3ac4ed00c7d1248 ] For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv with NULL after the first free. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20240727-bus_register_fix-v1-1-fed8dd0dba7a@quicinc.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

module: don't ignore sysfs_create_link() failures

2024-06-12T09:12:17+00:00

[ Upstream commit 85d2b0aa170351380be39fe4ff7973df1427fe76 ] The sysfs_create_link() return code is marked as __must_check, but the module_add_driver() function tries hard to not care, by assigning the return code to a variable. When building with 'make W=1', gcc still warns because this variable is only assigned but not used: drivers/base/module.c: In function 'module_add_driver': drivers/base/module.c:36:6: warning: variable 'no_warn' set but not used [-Wunused-but-set-variable] Rework the code to properly unwind and return the error code to the caller. My reading of the original code was that it tries to not fail when the links already exist, so keep ignoring -EEXIST errors. Fixes: e17e0f51aeea ("Driver core: show drivers in /sys/module/") See-also: 4a7fb6363f2d ("add __must_check to device management code") Signed-off-by: Arnd Bergmann Reviewed-by: Luis Chamberlain Link: https://lore.kernel.org/r/20240408080616.3911573-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

driver core: bus: constify bus_get()

2023-03-23T12:21:24+00:00

It's funny to think about getting a reference count of a constant structure pointer, but this locks into place the private data "underneath" the struct bus_type() which is important to not go away while we are working with the bus structure for some callbacks. Cc: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20230313182918.1312597-27-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

driver core: bus: constify driver_find()

2023-03-23T12:21:22+00:00

The driver_find() function can now take a const * to bus_type, not just a * so fix that up. Cc: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20230313182918.1312597-26-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

driver core: bus: constify bus_rescan_devices()

2023-03-23T12:21:20+00:00

The bus_rescan_devices() function was missed in the previous change of the bus_for_each* constant pointer changes, so fix it up now to take a const * to struct bus_type. Cc: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20230313182918.1312597-25-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

driver core: bus: constantify bus_register()

2023-03-23T12:21:17+00:00

bus_register() is now safe to take a constant * to bus_type, so make that change and mark the subsys_private bus_type * constant as well. Cc: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20230313182918.1312597-24-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman