[PATCH 09/12] s390/cio: use generic driver_override infrastructure
Vineeth Vijayan
vneethv at linux.ibm.com
Thu Mar 26 20:43:11 AEDT 2026
On 3/24/26 01:59, Danilo Krummrich wrote:
> When a driver is probed through __driver_attach(), the bus' match()
> callback is called without the device lock held, thus accessing the
> driver_override field without a lock, which can cause a UAF.
>
> Fix this by using the driver-core driver_override infrastructure taking
> care of proper locking internally.
>
> Note that calling match() from __driver_attach() without the device lock
> held is intentional. [1]
>
> Link:https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
> Reported-by: Gui-Dong Han<hanguidong02 at gmail.com>
> Closes:https://bugzilla.kernel.org/show_bug.cgi?id=220789
> Fixes: ebc3d1791503 ("s390/cio: introduce driver_override on the css bus")
> Signed-off-by: Danilo Krummrich<dakr at kernel.org>
> ---
Thank you Danilo.
Reviewed-by: Vineeth Vijayan <vneethv at linux.ibm.com>
More information about the Linuxppc-dev
mailing list