Messages in this thread | | | Date | Tue, 30 Apr 2024 09:20:10 +0200 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH] drivers: core: Make dev->driver usage safe in dev_uevent() |
| |
On Tue, Apr 30, 2024 at 06:55:31AM +0200, Dirk Behme wrote: > Inspired by the function dev_driver_string() in the same file make sure > in case of uninitialization dev->driver is used safely in dev_uevent(), > as well.
I think you are racing and just getting "lucky" with your change here, just like dev_driver_string() is doing there (that READ_ONCE() really isn't doing much to protect you...)
> This change is based on the observation of the following race condition: > > Thread #1: > ========== > > really_probe() { > ... > probe_failed: > ... > device_unbind_cleanup(dev) { > ... > dev->driver = NULL; // <= Failed probe sets dev->driver to NULL > ... > } > ... > } > > Thread #2: > ========== > > dev_uevent() {
Wait, how can dev_uevent() be called if probe fails? Who is calling that?
> ... > if (dev->driver) > // If dev->driver is NULLed from really_probe() from here on, > // after above check, the system crashes > add_uevent_var(env, "DRIVER=%s", dev->driver->name); > > dev_driver_string() can't be used here because we want NULL and not > anything else in the non-init case. > > Similar cases are reported by syzkaller in > > https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a > > But these are regarding the *initialization* of dev->driver > > dev->driver = drv; > > As this switches dev->driver to non-NULL these reports can be considered > to be false-positives (which should be "fixed" by this commit, as well, > though). > > Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class") > Cc: syzbot+ffa8143439596313a85a@syzkaller.appspotmail.com > Reviewed-by: Eugeniu Rosca <eugeniu.rosca@bosch.com> > Tested-by: Eugeniu Rosca <eugeniu.rosca@bosch.com> > Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com> > --- > drivers/base/core.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/drivers/base/core.c b/drivers/base/core.c > index 5f4e03336e68..99ead727c08f 100644 > --- a/drivers/base/core.c > +++ b/drivers/base/core.c > @@ -2639,6 +2639,7 @@ static const char *dev_uevent_name(const struct kobject *kobj) > static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) > { > const struct device *dev = kobj_to_dev(kobj); > + struct device_driver *drv; > int retval = 0; > > /* add device node properties if present */ > @@ -2667,8 +2668,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env) > if (dev->type && dev->type->name) > add_uevent_var(env, "DEVTYPE=%s", dev->type->name); > > - if (dev->driver) > - add_uevent_var(env, "DRIVER=%s", dev->driver->name); > + /* dev->driver can change to NULL underneath us because of unbinding > + * or failing probe(), so be careful about accessing it. > + */ > + drv = READ_ONCE(dev->driver); > + if (drv) > + add_uevent_var(env, "DRIVER=%s", drv->name);
Again, you are just reducing the window here. Maybe a bit, but not all that much overall as there is no real lock present.
So how is this actually solving anything? And who is calling a uevent on a device that is not probed properly? Userspace? Within the kernel? Something else?
thanks,
greg k-h
| |