[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 09/12] s390/cio: use generic driver_override infrastructure
- To: Danilo Krummrich <dakr@xxxxxxxxxx>, Russell King <linux@xxxxxxxxxxxxxxx>, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>, "Rafael J. Wysocki" <rafael@xxxxxxxxxx>, Ioana Ciornei <ioana.ciornei@xxxxxxx>, Nipun Gupta <nipun.gupta@xxxxxxx>, Nikhil Agarwal <nikhil.agarwal@xxxxxxx>, "K. Y. Srinivasan" <kys@xxxxxxxxxxxxx>, Haiyang Zhang <haiyangz@xxxxxxxxxxxxx>, Wei Liu <wei.liu@xxxxxxxxxx>, Dexuan Cui <decui@xxxxxxxxxxxxx>, Long Li <longli@xxxxxxxxxxxxx>, Bjorn Helgaas <bhelgaas@xxxxxxxxxx>, Armin Wolf <W_Armin@xxxxxx>, Bjorn Andersson <andersson@xxxxxxxxxx>, Mathieu Poirier <mathieu.poirier@xxxxxxxxxx>, Peter Oberparleiter <oberpar@xxxxxxxxxxxxx>, Heiko Carstens <hca@xxxxxxxxxxxxx>, Vasily Gorbik <gor@xxxxxxxxxxxxx>, Alexander Gordeev <agordeev@xxxxxxxxxxxxx>, Christian Borntraeger <borntraeger@xxxxxxxxxxxxx>, Sven Schnelle <svens@xxxxxxxxxxxxx>, Harald Freudenberger <freude@xxxxxxxxxxxxx>, Holger Dengler <dengler@xxxxxxxxxxxxx>, Mark Brown <broonie@xxxxxxxxxx>, "Michael S. Tsirkin" <mst@xxxxxxxxxx>, Jason Wang <jasowang@xxxxxxxxxx>, Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx>, Eugenio Pérez <eperezma@xxxxxxxxxx>, Alex Williamson <alex@xxxxxxxxxxx>, Juergen Gross <jgross@xxxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>, "Christophe Leroy (CS GROUP)" <chleroy@xxxxxxxxxx>
- From: Vineeth Vijayan <vneethv@xxxxxxxxxxxxx>
- Date: Thu, 26 Mar 2026 10:43:11 +0100
- Authentication-results: eu.smtp.expurgate.cloud; dkim=pass header.s=pp1 header.d=ibm.com header.i="@ibm.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"
- Cc: linux-kernel@xxxxxxxxxxxxxxx, driver-core@xxxxxxxxxxxxxxx, linuxppc-dev@xxxxxxxxxxxxxxxx, linux-hyperv@xxxxxxxxxxxxxxx, linux-pci@xxxxxxxxxxxxxxx, platform-driver-x86@xxxxxxxxxxxxxxx, linux-arm-msm@xxxxxxxxxxxxxxx, linux-remoteproc@xxxxxxxxxxxxxxx, linux-s390@xxxxxxxxxxxxxxx, linux-spi@xxxxxxxxxxxxxxx, virtualization@xxxxxxxxxxxxxxx, kvm@xxxxxxxxxxxxxxx, xen-devel@xxxxxxxxxxxxxxxxxxxx, linux-arm-kernel@xxxxxxxxxxxxxxxxxxx, Gui-Dong Han <hanguidong02@xxxxxxxxx>
- Delivery-date: Thu, 26 Mar 2026 10:15:15 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 3/24/26 01:59, Danilo Krummrich wrote:
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Link:https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@xxxxxxxxxx/
[1]
Reported-by: Gui-Dong Han<hanguidong02@xxxxxxxxx>
Closes:https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes: ebc3d1791503 ("s390/cio: introduce driver_override on the css bus")
Signed-off-by: Danilo Krummrich<dakr@xxxxxxxxxx>
---
Thank you Danilo.
Reviewed-by: Vineeth Vijayan <vneethv@xxxxxxxxxxxxx>
|
