linux-kernel - [PATCH] driver core: Fix error handling in driver API device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240717-device_rename_fix-v1-1-54d85024518f@quicinc.com>
Date: Wed, 17 Jul 2024 22:50:05 +0800
From: Zijun Hu <zijun_hu@...oud.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
 "Rafael J. Wysocki" <rafael@...nel.org>, 
 Benjamin Thery <benjamin.thery@...l.net>, 
 "Eric W. Biederman" <ebiederm@...ssion.com>
Cc: Zijun Hu <zijun_hu@...oud.com>, Greg Kroah-Hartman <gregkh@...e.de>, 
 linux-kernel@...r.kernel.org, Zijun Hu <quic_zijuhu@...cinc.com>
Subject: [PATCH] driver core: Fix error handling in driver API
 device_rename()

From: Zijun Hu <quic_zijuhu@...cinc.com>

Call failure of device_rename(@dev, @new_name) maybe unexpectedly change
link name within @dev's class directory to @new_name, fixed by correcting
error handling for the API.

Fixes: f349cf34731c ("driver core: Implement ns directory support for device classes.")
Signed-off-by: Zijun Hu <quic_zijuhu@...cinc.com>
---
 drivers/base/core.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/drivers/base/core.c b/drivers/base/core.c
index 2b4c0624b704..a05b7186cf33 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -4512,9 +4512,11 @@ EXPORT_SYMBOL_GPL(device_destroy);
  */
 int device_rename(struct device *dev, const char *new_name)
 {
+	struct subsys_private *sp = NULL;
 	struct kobject *kobj = &dev->kobj;
 	char *old_device_name = NULL;
 	int error;
+	bool is_link_renamed = false;
 
 	dev = get_device(dev);
 	if (!dev)
@@ -4529,7 +4531,7 @@ int device_rename(struct device *dev, const char *new_name)
 	}
 
 	if (dev->class) {
-		struct subsys_private *sp = class_to_subsys(dev->class);
+		sp = class_to_subsys(dev->class);
 
 		if (!sp) {
 			error = -EINVAL;
@@ -4537,17 +4539,20 @@ int device_rename(struct device *dev, const char *new_name)
 		}
 
 		error = sysfs_rename_link_ns(&sp->subsys.kobj, kobj, old_device_name,
-					     new_name, kobject_namespace(kobj));
-		subsys_put(sp);
+				new_name, kobject_namespace(kobj));
 		if (error)
 			goto out;
+
+		is_link_renamed = true;
 	}
 
 	error = kobject_rename(kobj, new_name);
-	if (error)
-		goto out;
-
 out:
+	if (error && is_link_renamed)
+		sysfs_rename_link_ns(&sp->subsys.kobj, kobj, new_name,
+				old_device_name, kobject_namespace(kobj));
+	subsys_put(sp);
+
 	put_device(dev);
 
 	kfree(old_device_name);

---
base-commit: 51835949dda3783d4639cfa74ce13a3c9829de00
change-id: 20240717-device_rename_fix-ecef084784e5

Best regards,
-- 
Zijun Hu <quic_zijuhu@...cinc.com>