linux-kernel - Re: [PATCH 1/1] driver core: Fix driver_sysfs_remove() order in really

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YcwyyXuqJ3QVevYW@kroah.com>
Date:   Wed, 29 Dec 2021 11:04:57 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Lu Baolu <baolu.lu@...ux.intel.com>
Cc:     "Rafael J . Wysocki" <rafael@...nel.org>,
        Kay Sievers <kay.sievers@...ell.com>,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH 1/1] driver core: Fix driver_sysfs_remove() order in
 really_probe()

On Wed, Dec 29, 2021 at 12:51:59PM +0800, Lu Baolu wrote:
> The driver_sysfs_remove() should always be called after successful
> driver_sysfs_add(). Otherwise, NULL pointers will be passed to the
> sysfs_remove_link(), where it is decoded as searching sysfs root.

What null pointer is being sent to sysfs_remove_link()?  For which link?

How are you triggering this failure path and how was it tested?

> 
> Fixes: 1901fb2604fbc ("Driver core: fix "driver" symlink timing")
> Cc: stable@...r.kernel.org
> Signed-off-by: Lu Baolu <baolu.lu@...ux.intel.com>
> ---
>  drivers/base/dd.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> index 68ea1f949daa..9eaaff2f556c 100644
> --- a/drivers/base/dd.c
> +++ b/drivers/base/dd.c
> @@ -577,14 +577,14 @@ static int really_probe(struct device *dev, struct device_driver *drv)
>  	if (dev->bus->dma_configure) {
>  		ret = dev->bus->dma_configure(dev);
>  		if (ret)
> -			goto probe_failed;
> +			goto pinctrl_bind_failed;

Why not call the notifier chain here?  Did you verify that this change
still works properly?

thanks,

greg k-h