6.18-stable patches

added patches:
	driver-core-reject-devices-with-unregistered-buses.patch

diff --git a/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch b/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch
new file mode 100644 (file)
index 0000000..73a8063
--- /dev/null
+++ b/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch
@@ -0,0 +1,62 @@
+From 36f35b8df6972167102a1c3d4361e0afb6a84534 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 30 Apr 2026 11:17:18 +0200
+Subject: driver core: reject devices with unregistered buses
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 36f35b8df6972167102a1c3d4361e0afb6a84534 upstream.
+
+Trying to register a device on a bus which has not yet been registered
+used to trigger a NULL-pointer dereference, but since the const bus
+structure rework registration instead succeeds without the device being
+added to the bus.
+
+This specifically means that the device will never bind to a driver and
+that the bus sysfs attributes are not created (i.e. as if the device had
+no bus).
+
+Reject devices with unregistered buses to catch any callers that get
+the ordering wrong and to handle bus registration failures more
+gracefully.
+
+Fixes: 5221b82d46f2 ("driver core: bus: bus_add/probe/remove_device() cleanups")
+Cc: stable@vger.kernel.org     # 6.3
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260430091718.230228-1-johan@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/bus.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -506,10 +506,10 @@ static const struct attribute_group driv
+  */
+ int bus_add_device(struct device *dev)
+ {
+-      struct subsys_private *sp = bus_to_subsys(dev->bus);
++      struct subsys_private *sp;
+       int error;
+ 
+-      if (!sp) {
++      if (!dev->bus) {
+               /*
+                * This is a normal operation for many devices that do not
+                * have a bus assigned to them, just say that all went
+@@ -518,6 +518,13 @@ int bus_add_device(struct device *dev)
+               return 0;
+       }
+ 
++      sp = bus_to_subsys(dev->bus);
++      if (!sp) {
++              pr_err("%s: cannot add device '%s' to unregistered bus '%s'\n",
++                     __func__, dev_name(dev), dev->bus->name);
++              return -EINVAL;
++      }
++
+       /*
+        * Reference in sp is now incremented and will be dropped when
+        * the device is removed from the bus

diff --git a/queue-6.18/series b/queue-6.18/series
index d9b5e709fccd96346ea70c56f113d0ef2538e3c8..7d568f769a9c7c8516abd63306c2e8ebef817edd 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -302,3 +302,4 @@ drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch
 drm-amd-display-fix-out-of-bounds-read-in-dp_get_eq_aux_rd_interval.patch
 drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch
 fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch
+driver-core-reject-devices-with-unregistered-buses.patch