[PATCH 02/12] bus: fsl-mc: use generic driver_override infrastructure

Ioana Ciornei ioana.ciornei at nxp.com
Wed Mar 25 23:01:29 AEDT 2026


On Tue, Mar 24, 2026 at 01:59:06AM +0100, Danilo Krummrich wrote:
> When a driver is probed through __driver_attach(), the bus' match()
> callback is called without the device lock held, thus accessing the
> driver_override field without a lock, which can cause a UAF.
> 
> Fix this by using the driver-core driver_override infrastructure taking
> care of proper locking internally.
> 
> Note that calling match() from __driver_attach() without the device lock
> held is intentional. [1]
> 
> Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
> Reported-by: Gui-Dong Han <hanguidong02 at gmail.com>
> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
> Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
> Signed-off-by: Danilo Krummrich <dakr at kernel.org>

Tested-by: Ioana Ciornei <ioana.ciornei at nxp.com>
Signed-off-by: Ioana Ciornei <ioana.ciornei at nxp.com>



More information about the Linuxppc-dev mailing list