Messages in this thread Patch in this message | | | From | Dirk Behme <> | Subject | [PATCH] drivers: core: Make dev->driver usage safe in dev_uevent() | Date | Tue, 30 Apr 2024 06:55:31 +0200 |
| |
Inspired by the function dev_driver_string() in the same file make sure in case of uninitialization dev->driver is used safely in dev_uevent(), as well.
This change is based on the observation of the following race condition:
Thread #1: ==========
really_probe() { .. probe_failed: .. device_unbind_cleanup(dev) { ... dev->driver = NULL; // <= Failed probe sets dev->driver to NULL ... } .. }
Thread #2: ==========
dev_uevent() { .. if (dev->driver) // If dev->driver is NULLed from really_probe() from here on, // after above check, the system crashes add_uevent_var(env, "DRIVER=%s", dev->driver->name);
dev_driver_string() can't be used here because we want NULL and not anything else in the non-init case.
Similar cases are reported by syzkaller in
https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a
But these are regarding the *initialization* of dev->driver
dev->driver = drv;
As this switches dev->driver to non-NULL these reports can be considered to be false-positives (which should be "fixed" by this commit, as well, though).
Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class") Cc: syzbot+ffa8143439596313a85a@syzkaller.appspotmail.com Reviewed-by: Eugeniu Rosca <eugeniu.rosca@bosch.com> Tested-by: Eugeniu Rosca <eugeniu.rosca@bosch.com> Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> --- drivers/base/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/base/core.c b/drivers/base/core.c index 5f4e03336e68..99ead727c08f 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -2639,6 +2639,7 @@ static const char *dev_uevent_name(const struct kobject *kobj) static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) { const struct device *dev = kobj_to_dev(kobj); + struct device_driver *drv; int retval = 0; /* add device node properties if present */ @@ -2667,8 +2668,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) if (dev->type && dev->type->name) add_uevent_var(env, "DEVTYPE=%s", dev->type->name); - if (dev->driver) - add_uevent_var(env, "DRIVER=%s", dev->driver->name); + /* dev->driver can change to NULL underneath us because of unbinding + * or failing probe(), so be careful about accessing it. + */ + drv = READ_ONCE(dev->driver); + if (drv) + add_uevent_var(env, "DRIVER=%s", drv->name); /* Add common DT information about the device */ of_device_uevent(dev, env); -- 2.28.0
| |