sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
linux/drivers/bus
History
Danilo Krummrich 2b38efc05b driver core: platform: use generic driver_override infrastructure 
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]

Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes: 3d713e0e38 ("driver core: platform: add device binding path 'driver_override'")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
 		2026-03-17 20:30:57 +01:00
..
fsl-mc Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mhi Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
Kconfig bus: omap-ocp2scp: enable compile testing 2026-01-14 14:33:35 -08:00
Makefile bus: add driver for IMX AIPSTZ bridge 2025-07-01 22:23:21 +08:00
arm-cci.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
arm-integrator-lm.c bus: integrator-lm: fix OF node leak in probe() 2024-09-02 10:18:43 +02:00
brcmstb_gisb.c bus: brcmstb_gisb: use dev_groups to register attribute groups 2025-04-07 10:35:43 -07:00
bt1-apb.c bus: bt1-apb: change to use devm_clk_get_enabled() helper 2024-08-29 10:45:13 +02:00
bt1-axi.c bus: bt1-axi: change to use devm_clk_get_enabled() helper 2024-08-29 10:44:53 +02:00
da8xx-mstpri.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
hisi_lpc.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
imx-aipstz.c bus: imx-aipstz: allow creating pdevs for child buses 2025-07-11 16:32:08 +08:00
imx-weim.c bus: imx-weim: change to use devm_clk_get_enabled() helper 2024-09-01 17:06:33 +08:00
intel-ixp4xx-eb.c bus: ixp4xx: fix IXP4XX_EXP_T1_MASK 2023-07-05 22:22:55 +02:00
mips_cdmm.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
moxtet.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
mvebu-mbus.c syscore: Pass context data to callbacks 2025-11-14 10:01:52 +01:00
omap-ocp2scp.c bus: omap-ocp2scp: fix OF populate on driver rebind 2026-01-14 14:33:16 -08:00
omap_l3_noc.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
omap_l3_noc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_320.RULE 2022-06-10 14:51:36 +02:00
omap_l3_smx.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
omap_l3_smx.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
qcom-ebi2.c bus: qcom-ebi2: Simplify with scoped for each OF child loop 2026-01-02 13:59:31 -06:00
qcom-ssc-block-bus.c bus: qcom-ssc-block-bus: Fix the error handling path of qcom_ssc_block_bus_probe() 2025-03-13 17:11:56 -05:00
simple-pm-bus.c driver core: platform: use generic driver_override infrastructure 2026-03-17 20:30:57 +01:00
stm32_etzpc.c bus: etzpc: introduce ETZPC firewall controller driver 2024-04-25 14:44:39 +02:00
stm32_firewall.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stm32_firewall.h firewall: introduce stm32_firewall framework 2024-04-05 16:49:14 +02:00
stm32_rifsc.c bus: rifsc: add debugfs entry to dump the firewall configuration 2025-11-14 09:49:09 +01:00
sun50i-de2.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
sunxi-rsb.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
tegra-aconnect.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
tegra-gmi.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
ti-pwmss.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
ti-sysc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ts-nbus.c bus: Switch back to struct platform_driver::remove() 2024-11-12 15:53:37 +01:00
uniphier-system-bus.c bus: uniphier-system-bus: Remove open coded "ranges" parsing 2023-03-30 13:37:21 -05:00
vexpress-config.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00