Commit 2b38efc0 authored by Danilo Krummrich's avatar Danilo Krummrich
Browse files

driver core: platform: use generic driver_override infrastructure 

When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]

Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/

 [1]
Reported-by: default avatarGui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789


Fixes: 3d713e0e ("driver core: platform: add device binding path 'driver_override'")
Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org


Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
parent c5f60e3f

drivers/base/platform.c

+5 −32
Original line number Diff line number Diff line
@@ -603,7 +603,6 @@ static void platform_device_release(struct device *dev) 
	kfree(pa->pdev.dev.platform_data);

	kfree(pa->pdev.mfd_cell);

	kfree(pa->pdev.resource);

	kfree(pa->pdev.driver_override);

	kfree(pa);

}
@@ -1306,38 +1305,9 @@ static ssize_t numa_node_show(struct device *dev, 
}

static DEVICE_ATTR_RO(numa_node);



static ssize_t driver_override_show(struct device *dev,

				    struct device_attribute *attr, char *buf)

{

	struct platform_device *pdev = to_platform_device(dev);

	ssize_t len;



	device_lock(dev);

	len = sysfs_emit(buf, "%s\n", pdev->driver_override);

	device_unlock(dev);



	return len;

}



static ssize_t driver_override_store(struct device *dev,

				     struct device_attribute *attr,

				     const char *buf, size_t count)

{

	struct platform_device *pdev = to_platform_device(dev);

	int ret;



	ret = driver_set_override(dev, &pdev->driver_override, buf, count);

	if (ret)

		return ret;



	return count;

}

static DEVICE_ATTR_RW(driver_override);



static struct attribute *platform_dev_attrs[] = {

	&dev_attr_modalias.attr,

	&dev_attr_numa_node.attr,

	&dev_attr_driver_override.attr,

	NULL,

};
@@ -1377,10 +1347,12 @@ static int platform_match(struct device *dev, const struct device_driver *drv) 
{

	struct platform_device *pdev = to_platform_device(dev);

	struct platform_driver *pdrv = to_platform_driver(drv);

	int ret;



	/* When driver_override is set, only bind to the matching driver */

	if (pdev->driver_override)

		return !strcmp(pdev->driver_override, drv->name);

	ret = device_match_driver_override(dev, drv);

	if (ret >= 0)

		return ret;



	/* Attempt an OF style match first */

	if (of_driver_match_device(dev, drv))
@@ -1516,6 +1488,7 @@ static const struct dev_pm_ops platform_dev_pm_ops = { 
const struct bus_type platform_bus_type = {

	.name		= "platform",

	.dev_groups	= platform_dev_groups,

	.driver_override = true,

	.match		= platform_match,

	.uevent		= platform_uevent,

	.probe		= platform_probe,

drivers/bus/simple-pm-bus.c

+2 −2
Original line number Diff line number Diff line
@@ -36,7 +36,7 @@ static int simple_pm_bus_probe(struct platform_device *pdev) 
	 * that's not listed in simple_pm_bus_of_match. We don't want to do any

	 * of the simple-pm-bus tasks for these devices, so return early.

	 */

	if (pdev->driver_override)

	if (device_has_driver_override(&pdev->dev))

		return 0;



	match = of_match_device(dev->driver->of_match_table, dev);
@@ -78,7 +78,7 @@ static void simple_pm_bus_remove(struct platform_device *pdev) 
{

	const void *data = of_device_get_match_data(&pdev->dev);



	if (pdev->driver_override || data)

	if (device_has_driver_override(&pdev->dev) || data)

		return;



	dev_dbg(&pdev->dev, "%s\n", __func__);

drivers/clk/imx/clk-scu.c

+1 −2
Original line number Diff line number Diff line
@@ -706,8 +706,7 @@ struct clk_hw *imx_clk_scu_alloc_dev(const char *name, 
	if (ret)

		goto put_device;



	ret = driver_set_override(&pdev->dev, &pdev->driver_override,

				  "imx-scu-clk", strlen("imx-scu-clk"));

	ret = device_set_driver_override(&pdev->dev, "imx-scu-clk");

	if (ret)

		goto put_device;

drivers/slimbus/qcom-ngd-ctrl.c

+2 −4
Original line number Diff line number Diff line
@@ -1535,10 +1535,8 @@ static int of_qcom_slim_ngd_register(struct device *parent, 
		ngd->id = id;

		ngd->pdev->dev.parent = parent;



		ret = driver_set_override(&ngd->pdev->dev,

					  &ngd->pdev->driver_override,

					  QCOM_SLIM_NGD_DRV_NAME,

					  strlen(QCOM_SLIM_NGD_DRV_NAME));

		ret = device_set_driver_override(&ngd->pdev->dev,

						 QCOM_SLIM_NGD_DRV_NAME);

		if (ret) {

			platform_device_put(ngd->pdev);

			kfree(ngd);

include/linux/platform_device.h

+0 −5
Original line number Diff line number Diff line
@@ -31,11 +31,6 @@ struct platform_device { 
	struct resource	*resource;



	const struct platform_device_id	*id_entry;

	/*

	 * Driver name to force a match.  Do not set directly, because core

	 * frees it.  Use driver_set_override() to set or clear it.

	 */

	const char *driver_override;



	/* MFD cell pointer */

	struct mfd_cell *mfd_cell;