From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 15 Jun 2026 16:55:42 +0000 (+0200)
Subject: 6.18-stable patches
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29e15e36f83d22ed14f641524af4912b8a2c79b8;p=thirdparty%2Fkernel%2Fstable-queue.git

6.18-stable patches

added patches:
	driver-core-reject-devices-with-unregistered-buses.patch
---

diff --git a/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch b/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch
new file mode 100644
index 0000000000..73a8063e31
--- /dev/null
+++ b/queue-6.18/driver-core-reject-devices-with-unregistered-buses.patch
@@ -0,0 +1,62 @@
+From 36f35b8df6972167102a1c3d4361e0afb6a84534 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 30 Apr 2026 11:17:18 +0200
+Subject: driver core: reject devices with unregistered buses
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 36f35b8df6972167102a1c3d4361e0afb6a84534 upstream.
+
+Trying to register a device on a bus which has not yet been registered
+used to trigger a NULL-pointer dereference, but since the const bus
+structure rework registration instead succeeds without the device being
+added to the bus.
+
+This specifically means that the device will never bind to a driver and
+that the bus sysfs attributes are not created (i.e. as if the device had
+no bus).
+
+Reject devices with unregistered buses to catch any callers that get
+the ordering wrong and to handle bus registration failures more
+gracefully.
+
+Fixes: 5221b82d46f2 ("driver core: bus: bus_add/probe/remove_device() cleanups")
+Cc: stable@vger.kernel.org	# 6.3
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20260430091718.230228-1-johan@kernel.org
+Signed-off-by: Danilo Krummrich <dakr@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/bus.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -506,10 +506,10 @@ static const struct attribute_group driv
+  */
+ int bus_add_device(struct device *dev)
+ {
+-	struct subsys_private *sp = bus_to_subsys(dev->bus);
++	struct subsys_private *sp;
+ 	int error;
+ 
+-	if (!sp) {
++	if (!dev->bus) {
+ 		/*
+ 		 * This is a normal operation for many devices that do not
+ 		 * have a bus assigned to them, just say that all went
+@@ -518,6 +518,13 @@ int bus_add_device(struct device *dev)
+ 		return 0;
+ 	}
+ 
++	sp = bus_to_subsys(dev->bus);
++	if (!sp) {
++		pr_err("%s: cannot add device '%s' to unregistered bus '%s'\n",
++		       __func__, dev_name(dev), dev->bus->name);
++		return -EINVAL;
++	}
++
+ 	/*
+ 	 * Reference in sp is now incremented and will be dropped when
+ 	 * the device is removed from the bus
diff --git a/queue-6.18/series b/queue-6.18/series
index d9b5e709fc..7d568f769a 100644
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -302,3 +302,4 @@ drm-amd-display-fix-null-deref-and-buffer-over-read-in-sdp-debugfs.patch
 drm-amd-display-fix-out-of-bounds-read-in-dp_get_eq_aux_rd_interval.patch
 drm-amd-display-use-krealloc_array-in-dal_vector_reserve.patch
 fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch
+driver-core-reject-devices-with-unregistered-buses.patch