linux-kernel - Re: [PATCH v4] driver core: enforce device_lock for driver_match

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJZ5v0hL3NE+aUQfYdddm+UhdybxJMwyHPMC+WvDUiVGK3FgDA@mail.gmail.com>
Date: Tue, 13 Jan 2026 17:02:52 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Gui-Dong Han <hanguidong02@...il.com>
Cc: "Rafael J. Wysocki" <rafael@...nel.org>, gregkh@...uxfoundation.org, dakr@...nel.org, 
	linux-kernel@...r.kernel.org, baijiaju1990@...il.com, 
	Qiu-ji Chen <chenqiuji666@...il.com>
Subject: Re: [PATCH v4] driver core: enforce device_lock for driver_match_device()

On Tue, Jan 13, 2026 at 4:56 PM Gui-Dong Han <hanguidong02@...il.com> wrote:
>
> On Tue, Jan 13, 2026 at 11:20 PM Rafael J. Wysocki <rafael@...nel.org> wrote:
> >
> > On Tue, Jan 13, 2026 at 4:05 PM Gui-Dong Han <hanguidong02@...il.com> wrote:
> > >
> > > Currently, driver_match_device() is called from three sites. One site
> > > (__device_attach_driver) holds device_lock(dev), but the other two
> > > (bind_store and __driver_attach) do not. This inconsistency means that
> > > bus match() callbacks are not guaranteed to be called with the lock
> > > held.
> > >
> > > Fix this by holding device_lock(dev) around the driver_match_device()
> > > calls in bind_store() and __driver_attach(). This ensures consistent
> > > locking for all match() callbacks. Also add a lock assertion to
> > > driver_match_device() to enforce this guarantee.
> > >
> > > This consistency also fixes a known race condition. The driver_override
> > > implementation relies on the device_lock, so the missing lock led to the
> > > use-after-free (UAF) reported in Bugzilla for buses using this field.
> > >
> > > Stress testing the two newly locked paths for 24 hours with
> > > CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
> > > and no lockdep warnings.
> > >
> > > Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> > > Suggested-by: Qiu-ji Chen <chenqiuji666@...il.com>
> > > Signed-off-by: Gui-Dong Han <hanguidong02@...il.com>
> > > ---
> > > v4:
> > > * Remove the misleading comment above device_lock_assert(), and update
> > > subject and commit message to focus on enforcing consistent locking,
> > > as discussed with Danilo Krummrich.
> > > v3:
> > > * Remove redundant locking comments at call sites and add a blank line
> > > after the lock assertion in driver_match_device(), as suggested by Greg KH.
> > > v2:
> > > * Add device_lock_assert() in driver_match_device() to enforce locking
> > > requirement, as suggested by Greg KH.
> > > v1:
> > > * The Bugzilla entry contains full KASAN reports and two PoCs that reliably
> > > reproduce the UAF on both unlocked paths using a standard QEMU setup
> > > (default e1000 device at 0000:00:03.0).
> > > ---
> > >  drivers/base/base.h |  2 ++
> > >  drivers/base/bus.c  | 16 +++++++++++-----
> > >  drivers/base/dd.c   |  2 ++
> > >  3 files changed, 15 insertions(+), 5 deletions(-)
> > >
> > > diff --git a/drivers/base/base.h b/drivers/base/base.h
> > > index 430cbefbc97f..aa701878c6e3 100644
> > > --- a/drivers/base/base.h
> > > +++ b/drivers/base/base.h
> > > @@ -182,6 +182,8 @@ void device_set_deferred_probe_reason(const struct device *dev, struct va_format
> > >  static inline int driver_match_device(const struct device_driver *drv,
> > >                                       struct device *dev)
> > >  {
> > > +       device_lock_assert(dev);
> > > +
> > >         return drv->bus->match ? drv->bus->match(dev, drv) : 1;
> > >  }
> > >
> > > diff --git a/drivers/base/bus.c b/drivers/base/bus.c
> > > index 9eb7771706f0..5cbcf9f5bd6e 100644
> > > --- a/drivers/base/bus.c
> > > +++ b/drivers/base/bus.c
> > > @@ -261,13 +261,19 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
> > >         const struct bus_type *bus = bus_get(drv->bus);
> > >         struct device *dev;
> > >         int err = -ENODEV;
> > > +       int ret;
> > >
> > >         dev = bus_find_device_by_name(bus, NULL, buf);
> > > -       if (dev && driver_match_device(drv, dev)) {
> > > -               err = device_driver_attach(drv, dev);
> > > -               if (!err) {
> > > -                       /* success */
> > > -                       err = count;
> > > +       if (dev) {
> > > +               device_lock(dev);
> > > +               ret = driver_match_device(drv, dev);
> > > +               device_unlock(dev);
> > > +               if (ret) {
> > > +                       err = device_driver_attach(drv, dev);
> > > +                       if (!err) {
> > > +                               /* success */
> > > +                               err = count;
> > > +                       }
> > >                 }
> > >         }
> > >         put_device(dev);
> > > diff --git a/drivers/base/dd.c b/drivers/base/dd.c
> > > index 349f31bedfa1..e79c732a56e4 100644
> > > --- a/drivers/base/dd.c
> > > +++ b/drivers/base/dd.c
> > > @@ -1178,7 +1178,9 @@ static int __driver_attach(struct device *dev, void *data)
> > >          * is an error.
> > >          */
> > >
> > > +       device_lock(dev);
> > >         ret = driver_match_device(drv, dev);
> > > +       device_unlock(dev);
> >
> > This repeats the pattern above, so maybe add a helper function for it?
>
> Hi Rafael,
>
> The three call sites for driver_match_device() have been stable for
> over a decade.

Yes, they have, but now it's changing.

> With only two sites requiring the lock, and no new
> callers anticipated, adding a helper function seems to have limited
> value.

It would reduce code duplication.  Why is this limited value?