Commit 85bb534f authored by Danilo Krummrich's avatar Danilo Krummrich
Browse files

vdpa: use generic driver_override infrastructure 

When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]

Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/

 [1]
Reported-by: default avatarGui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789


Fixes: 539fec78 ("vdpa: add driver_override support")
Acked-by: default avatarEugenio Pérez <eperezma@redhat.com>
Acked-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org


Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
parent 8a700b1f

drivers/vdpa/vdpa.c

+5 −43
Original line number Diff line number Diff line
@@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) 


static int vdpa_dev_match(struct device *dev, const struct device_driver *drv)

{

	struct vdpa_device *vdev = dev_to_vdpa(dev);

	int ret;



	/* Check override first, and if set, only use the named driver */

	if (vdev->driver_override)

		return strcmp(vdev->driver_override, drv->name) == 0;

	ret = device_match_driver_override(dev, drv);

	if (ret >= 0)

		return ret;



	/* Currently devices must be supported by all vDPA bus drivers */

	return 1;

}



static ssize_t driver_override_store(struct device *dev,

				     struct device_attribute *attr,

				     const char *buf, size_t count)

{

	struct vdpa_device *vdev = dev_to_vdpa(dev);

	int ret;



	ret = driver_set_override(dev, &vdev->driver_override, buf, count);

	if (ret)

		return ret;



	return count;

}



static ssize_t driver_override_show(struct device *dev,

				    struct device_attribute *attr, char *buf)

{

	struct vdpa_device *vdev = dev_to_vdpa(dev);

	ssize_t len;



	device_lock(dev);

	len = sysfs_emit(buf, "%s\n", vdev->driver_override);

	device_unlock(dev);



	return len;

}

static DEVICE_ATTR_RW(driver_override);



static struct attribute *vdpa_dev_attrs[] = {

	&dev_attr_driver_override.attr,

	NULL,

};



static const struct attribute_group vdpa_dev_group = {

	.attrs  = vdpa_dev_attrs,

};

__ATTRIBUTE_GROUPS(vdpa_dev);



static const struct bus_type vdpa_bus = {

	.name  = "vdpa",

	.dev_groups = vdpa_dev_groups,

	.driver_override = true,

	.match = vdpa_dev_match,

	.probe = vdpa_dev_probe,

	.remove = vdpa_dev_remove,
@@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) 
		ops->free(vdev);



	ida_free(&vdpa_index_ida, vdev->index);

	kfree(vdev->driver_override);

	kfree(vdev);

}

include/linux/vdpa.h

+0 −4
Original line number Diff line number Diff line
@@ -72,9 +72,6 @@ struct vdpa_mgmt_dev; 
 * struct vdpa_device - representation of a vDPA device

 * @dev: underlying device

 * @vmap: the metadata passed to upper layer to be used for mapping

 * @driver_override: driver name to force a match; do not set directly,

 *                   because core frees it; use driver_set_override() to

 *                   set or clear it.

 * @config: the configuration ops for this device.

 * @map: the map ops for this device

 * @cf_lock: Protects get and set access to configuration layout.
@@ -90,7 +87,6 @@ struct vdpa_mgmt_dev; 
struct vdpa_device {

	struct device dev;

	union virtio_map vmap;

	const char *driver_override;

	const struct vdpa_config_ops *config;

	const struct virtio_map_ops *map;

	struct rw_semaphore cf_lock; /* Protects get/set config */