7.1-stable patches

added patches:
	driver-core-faux-fix-root-device-registration.patch
	driver-core-reject-devices-with-unregistered-buses.patch

diff --git a/queue-7.1/driver-core-faux-fix-root-device-registration.patch b/queue-7.1/driver-core-faux-fix-root-device-registration.patch
new file mode 100644 (file)
index 0000000..2978413
--- /dev/null
+++ b/queue-7.1/driver-core-faux-fix-root-device-registration.patch
@@ -0,0 +1,83 @@
+From 580a795105dae2ef1622df72a27a8fb0605e2f6b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Fri, 24 Apr 2026 17:31:26 +0200
+Subject: driver core: faux: fix root device registration
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 580a795105dae2ef1622df72a27a8fb0605e2f6b upstream.
+
+A recent change made the faux bus root device be allocated dynamically
+but failed to provide a release function to free the memory when the
+last reference is dropped (on theoretical failure to register the device
+or bus).
+
+Fix this by using root_device_register() instead of open coding.
+
+Also add the missing sanity check when registering faux devices to avoid
+use-after-free if the bus failed to register (which would previously
+have triggered a bunch of use-after-free warnings).
+
+Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
+Cc: stable@vger.kernel.org     # 7.0
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260424153127.2647405-2-johan@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/faux.c |   22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/base/faux.c
++++ b/drivers/base/faux.c
+@@ -133,6 +133,9 @@ struct faux_device *faux_device_create_w
+       struct device *dev;
+       int ret;
+ 
++      if (!faux_bus_root)
++              return NULL;
++
+       faux_obj = kzalloc_obj(*faux_obj);
+       if (!faux_obj)
+               return NULL;
+@@ -232,19 +235,12 @@ EXPORT_SYMBOL_GPL(faux_device_destroy);
+ 
+ int __init faux_bus_init(void)
+ {
++      struct device *root;
+       int ret;
+ 
+-      faux_bus_root = kzalloc_obj(*faux_bus_root);
+-      if (!faux_bus_root)
+-              return -ENOMEM;
+-
+-      dev_set_name(faux_bus_root, "faux");
+-
+-      ret = device_register(faux_bus_root);
+-      if (ret) {
+-              put_device(faux_bus_root);
+-              return ret;
+-      }
++      root = root_device_register("faux");
++      if (IS_ERR(root))
++              return PTR_ERR(root);
+ 
+       ret = bus_register(&faux_bus_type);
+       if (ret)
+@@ -254,12 +250,14 @@ int __init faux_bus_init(void)
+       if (ret)
+               goto error_driver;
+ 
++      faux_bus_root = root;
++
+       return ret;
+ 
+ error_driver:
+       bus_unregister(&faux_bus_type);
+ 
+ error_bus:
+-      device_unregister(faux_bus_root);
++      root_device_unregister(root);
+       return ret;
+ }

diff --git a/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch b/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch
new file mode 100644 (file)
index 0000000..3bb7114
--- /dev/null
+++ b/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch
@@ -0,0 +1,62 @@
+From 36f35b8df6972167102a1c3d4361e0afb6a84534 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 30 Apr 2026 11:17:18 +0200
+Subject: driver core: reject devices with unregistered buses
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 36f35b8df6972167102a1c3d4361e0afb6a84534 upstream.
+
+Trying to register a device on a bus which has not yet been registered
+used to trigger a NULL-pointer dereference, but since the const bus
+structure rework registration instead succeeds without the device being
+added to the bus.
+
+This specifically means that the device will never bind to a driver and
+that the bus sysfs attributes are not created (i.e. as if the device had
+no bus).
+
+Reject devices with unregistered buses to catch any callers that get
+the ordering wrong and to handle bus registration failures more
+gracefully.
+
+Fixes: 5221b82d46f2 ("driver core: bus: bus_add/probe/remove_device() cleanups")
+Cc: stable@vger.kernel.org     # 6.3
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260430091718.230228-1-johan@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/bus.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -544,10 +544,10 @@ static const struct attribute_group driv
+  */
+ int bus_add_device(struct device *dev)
+ {
+-      struct subsys_private *sp = bus_to_subsys(dev->bus);
++      struct subsys_private *sp;
+       int error;
+ 
+-      if (!sp) {
++      if (!dev->bus) {
+               /*
+                * This is a normal operation for many devices that do not
+                * have a bus assigned to them, just say that all went
+@@ -556,6 +556,13 @@ int bus_add_device(struct device *dev)
+               return 0;
+       }
+ 
++      sp = bus_to_subsys(dev->bus);
++      if (!sp) {
++              pr_err("%s: cannot add device '%s' to unregistered bus '%s'\n",
++                     __func__, dev_name(dev), dev->bus->name);
++              return -EINVAL;
++      }
++
+       /*
+        * Reference in sp is now incremented and will be dropped when
+        * the device is removed from the bus

diff --git a/queue-7.1/series b/queue-7.1/series
index a9e2d904a7333ee1d0a255f940c359ad3009aa42..a99e2ae37961789320ae7394d5e209dc4ca1cbe5 100644 (file)
--- a/queue-7.1/series
+++ b/queue-7.1/series
@@ -1 +1,3 @@
 fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch
+driver-core-faux-fix-root-device-registration.patch
+driver-core-reject-devices-with-unregistered-buses.patch