drop driver core patch

diff --git a/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch b/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch
deleted file mode 100644 (file)
index a49d9dc..0000000
--- a/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 218cdae1b856698d6af68be0cc296d3a0a8103de Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jan 2026 00:28:43 +0800
-Subject: driver core: enforce device_lock for driver_match_device()
-
-From: Gui-Dong Han <hanguidong02@gmail.com>
-
-[ Upstream commit dc23806a7c47ec5f1293aba407fb69519f976ee0 ]
-
-Currently, driver_match_device() is called from three sites. One site
-(__device_attach_driver) holds device_lock(dev), but the other two
-(bind_store and __driver_attach) do not. This inconsistency means that
-bus match() callbacks are not guaranteed to be called with the lock
-held.
-
-Fix this by introducing driver_match_device_locked(), which guarantees
-holding the device lock using a scoped guard. Replace the unlocked calls
-in bind_store() and __driver_attach() with this new helper. Also add a
-lock assertion to driver_match_device() to enforce this guarantee.
-
-This consistency also fixes a known race condition. The driver_override
-implementation relies on the device_lock, so the missing lock led to the
-use-after-free (UAF) reported in Bugzilla for buses using this field.
-
-Stress testing the two newly locked paths for 24 hours with
-CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
-and no lockdep warnings.
-
-Cc: stable@vger.kernel.org
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
-Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
-Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
-Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock")
-Reviewed-by: Danilo Krummrich <dakr@kernel.org>
-Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
-Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/base.h | 9 +++++++++
- drivers/base/bus.c  | 2 +-
- drivers/base/dd.c   | 2 +-
- 3 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/base/base.h b/drivers/base/base.h
-index 406d108e8510f..7aad54e1cf20b 100644
---- a/drivers/base/base.h
-+++ b/drivers/base/base.h
-@@ -144,10 +144,19 @@ extern void device_set_deferred_probe_reason(const struct device *dev,
- static inline int driver_match_device(struct device_driver *drv,
-                                     struct device *dev)
- {
-+      device_lock_assert(dev);
-+
-       return drv->bus->match ? drv->bus->match(dev, drv) : 1;
- }
- extern bool driver_allows_async_probing(struct device_driver *drv);
- 
-+static inline int driver_match_device_locked(const struct device_driver *drv,
-+                                           struct device *dev)
-+{
-+      guard(device)(dev);
-+      return driver_match_device(drv, dev);
-+}
-+
- static inline void dev_sync_state(struct device *dev)
- {
-       if (dev->bus->sync_state)
-diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 3ec131d877120..19af9e2469e4d 100644
---- a/drivers/base/bus.c
-+++ b/drivers/base/bus.c
-@@ -212,7 +212,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
-       int err = -ENODEV;
- 
-       dev = bus_find_device_by_name(bus, NULL, buf);
--      if (dev && driver_match_device(drv, dev)) {
-+      if (dev && driver_match_device_locked(drv, dev)) {
-               err = device_driver_attach(drv, dev);
-               if (!err) {
-                       /* success */
-diff --git a/drivers/base/dd.c b/drivers/base/dd.c
-index c0a6bc9c6d5f1..d17bc8279af68 100644
---- a/drivers/base/dd.c
-+++ b/drivers/base/dd.c
-@@ -1138,7 +1138,7 @@ static int __driver_attach(struct device *dev, void *data)
-        * is an error.
-        */
- 
--      ret = driver_match_device(drv, dev);
-+      ret = driver_match_device_locked(drv, dev);
-       if (ret == 0) {
-               /* no match */
-               return 0;
--- 
-2.51.0
-

diff --git a/queue-5.15/series b/queue-5.15/series
index 3ea23d3a5a46af146dbb7475458a9b0d51599570..989e0db83cf86e51ced46ec1233fe0d69250c1e3 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -23,7 +23,6 @@ bus-omap-ocp2scp-convert-to-platform-remove-callback.patch
 bus-omap-ocp2scp-fix-of-populate-on-driver-rebind.patch
 driver-core-make-state_synced-device-attribute-write.patch
 driver-core-add-a-guard-definition-for-the-device_lo.patch
-driver-core-enforce-device_lock-for-driver_match_dev.patch
 mfd-qcom-pm8xxx-switch-away-from-using-chained-irq-h.patch
 mfd-qcom-pm8xxx-convert-to-platform-remove-callback-.patch
 mfd-qcom-pm8xxx-fix-of-populate-on-driver-rebind.patch

diff --git a/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch b/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch
deleted file mode 100644 (file)
index 3228e41..0000000
--- a/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 43fcab97a217ccdc2da2d8644f88398dc061e1e9 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jan 2026 00:28:43 +0800
-Subject: driver core: enforce device_lock for driver_match_device()
-
-From: Gui-Dong Han <hanguidong02@gmail.com>
-
-[ Upstream commit dc23806a7c47ec5f1293aba407fb69519f976ee0 ]
-
-Currently, driver_match_device() is called from three sites. One site
-(__device_attach_driver) holds device_lock(dev), but the other two
-(bind_store and __driver_attach) do not. This inconsistency means that
-bus match() callbacks are not guaranteed to be called with the lock
-held.
-
-Fix this by introducing driver_match_device_locked(), which guarantees
-holding the device lock using a scoped guard. Replace the unlocked calls
-in bind_store() and __driver_attach() with this new helper. Also add a
-lock assertion to driver_match_device() to enforce this guarantee.
-
-This consistency also fixes a known race condition. The driver_override
-implementation relies on the device_lock, so the missing lock led to the
-use-after-free (UAF) reported in Bugzilla for buses using this field.
-
-Stress testing the two newly locked paths for 24 hours with
-CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence
-and no lockdep warnings.
-
-Cc: stable@vger.kernel.org
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
-Suggested-by: Qiu-ji Chen <chenqiuji666@gmail.com>
-Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
-Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock")
-Reviewed-by: Danilo Krummrich <dakr@kernel.org>
-Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
-Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com
-Signed-off-by: Danilo Krummrich <dakr@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/base/base.h | 9 +++++++++
- drivers/base/bus.c  | 2 +-
- drivers/base/dd.c   | 2 +-
- 3 files changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/base/base.h b/drivers/base/base.h
-index 2a6cf004dedc3..4e06810efe3e0 100644
---- a/drivers/base/base.h
-+++ b/drivers/base/base.h
-@@ -144,10 +144,19 @@ extern void device_set_deferred_probe_reason(const struct device *dev,
- static inline int driver_match_device(struct device_driver *drv,
-                                     struct device *dev)
- {
-+      device_lock_assert(dev);
-+
-       return drv->bus->match ? drv->bus->match(dev, drv) : 1;
- }
- extern bool driver_allows_async_probing(struct device_driver *drv);
- 
-+static inline int driver_match_device_locked(const struct device_driver *drv,
-+                                           struct device *dev)
-+{
-+      guard(device)(dev);
-+      return driver_match_device(drv, dev);
-+}
-+
- static inline void dev_sync_state(struct device *dev)
- {
-       if (dev->bus->sync_state)
-diff --git a/drivers/base/bus.c b/drivers/base/bus.c
-index 941532ddfdc68..78a64f2784d05 100644
---- a/drivers/base/bus.c
-+++ b/drivers/base/bus.c
-@@ -212,7 +212,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
-       int err = -ENODEV;
- 
-       dev = bus_find_device_by_name(bus, NULL, buf);
--      if (dev && driver_match_device(drv, dev)) {
-+      if (dev && driver_match_device_locked(drv, dev)) {
-               err = device_driver_attach(drv, dev);
-               if (!err) {
-                       /* success */
-diff --git a/drivers/base/dd.c b/drivers/base/dd.c
-index 6ad1b6eae65d6..02c846be7b174 100644
---- a/drivers/base/dd.c
-+++ b/drivers/base/dd.c
-@@ -1175,7 +1175,7 @@ static int __driver_attach(struct device *dev, void *data)
-        * is an error.
-        */
- 
--      ret = driver_match_device(drv, dev);
-+      ret = driver_match_device_locked(drv, dev);
-       if (ret == 0) {
-               /* no match */
-               return 0;
--- 
-2.51.0
-

diff --git a/queue-6.1/series b/queue-6.1/series
index 84c9edc52efacd3d831fd03ca5b7f6600f0073df..99ec6cce7cf1dfdfe424cb298d940978a6a61369 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -41,7 +41,6 @@ bus-omap-ocp2scp-convert-to-platform-remove-callback.patch
 bus-omap-ocp2scp-fix-of-populate-on-driver-rebind.patch
 driver-core-make-state_synced-device-attribute-write.patch
 driver-core-add-a-guard-definition-for-the-device_lo.patch
-driver-core-enforce-device_lock-for-driver_match_dev.patch
 ext4-make-ext4_es_remove_extent-return-void.patch
 ext4-get-rid-of-ppath-in-ext4_find_extent.patch
 ext4-get-rid-of-ppath-in-ext4_ext_create_new_leaf.patch