From: Greg Kroah-Hartman Date: Mon, 9 Mar 2026 07:34:09 +0000 (+0100) Subject: drop driver core patch X-Git-Tag: v6.19.7~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5508b4c4800efa0653b90244eeea1410c71c35e3;p=thirdparty%2Fkernel%2Fstable-queue.git drop driver core patch --- diff --git a/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch b/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch deleted file mode 100644 index a49d9dc504..0000000000 --- a/queue-5.15/driver-core-enforce-device_lock-for-driver_match_dev.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 218cdae1b856698d6af68be0cc296d3a0a8103de Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 14 Jan 2026 00:28:43 +0800 -Subject: driver core: enforce device_lock for driver_match_device() - -From: Gui-Dong Han - -[ Upstream commit dc23806a7c47ec5f1293aba407fb69519f976ee0 ] - -Currently, driver_match_device() is called from three sites. One site -(__device_attach_driver) holds device_lock(dev), but the other two -(bind_store and __driver_attach) do not. This inconsistency means that -bus match() callbacks are not guaranteed to be called with the lock -held. - -Fix this by introducing driver_match_device_locked(), which guarantees -holding the device lock using a scoped guard. Replace the unlocked calls -in bind_store() and __driver_attach() with this new helper. Also add a -lock assertion to driver_match_device() to enforce this guarantee. - -This consistency also fixes a known race condition. The driver_override -implementation relies on the device_lock, so the missing lock led to the -use-after-free (UAF) reported in Bugzilla for buses using this field. - -Stress testing the two newly locked paths for 24 hours with -CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence -and no lockdep warnings. - -Cc: stable@vger.kernel.org -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 -Suggested-by: Qiu-ji Chen -Signed-off-by: Gui-Dong Han -Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock") -Reviewed-by: Danilo Krummrich -Reviewed-by: Greg Kroah-Hartman -Reviewed-by: Rafael J. Wysocki (Intel) -Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/base/base.h | 9 +++++++++ - drivers/base/bus.c | 2 +- - drivers/base/dd.c | 2 +- - 3 files changed, 11 insertions(+), 2 deletions(-) - -diff --git a/drivers/base/base.h b/drivers/base/base.h -index 406d108e8510f..7aad54e1cf20b 100644 ---- a/drivers/base/base.h -+++ b/drivers/base/base.h -@@ -144,10 +144,19 @@ extern void device_set_deferred_probe_reason(const struct device *dev, - static inline int driver_match_device(struct device_driver *drv, - struct device *dev) - { -+ device_lock_assert(dev); -+ - return drv->bus->match ? drv->bus->match(dev, drv) : 1; - } - extern bool driver_allows_async_probing(struct device_driver *drv); - -+static inline int driver_match_device_locked(const struct device_driver *drv, -+ struct device *dev) -+{ -+ guard(device)(dev); -+ return driver_match_device(drv, dev); -+} -+ - static inline void dev_sync_state(struct device *dev) - { - if (dev->bus->sync_state) -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index 3ec131d877120..19af9e2469e4d 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -212,7 +212,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, - int err = -ENODEV; - - dev = bus_find_device_by_name(bus, NULL, buf); -- if (dev && driver_match_device(drv, dev)) { -+ if (dev && driver_match_device_locked(drv, dev)) { - err = device_driver_attach(drv, dev); - if (!err) { - /* success */ -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index c0a6bc9c6d5f1..d17bc8279af68 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -1138,7 +1138,7 @@ static int __driver_attach(struct device *dev, void *data) - * is an error. - */ - -- ret = driver_match_device(drv, dev); -+ ret = driver_match_device_locked(drv, dev); - if (ret == 0) { - /* no match */ - return 0; --- -2.51.0 - diff --git a/queue-5.15/series b/queue-5.15/series index 3ea23d3a5a..989e0db83c 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -23,7 +23,6 @@ bus-omap-ocp2scp-convert-to-platform-remove-callback.patch bus-omap-ocp2scp-fix-of-populate-on-driver-rebind.patch driver-core-make-state_synced-device-attribute-write.patch driver-core-add-a-guard-definition-for-the-device_lo.patch -driver-core-enforce-device_lock-for-driver_match_dev.patch mfd-qcom-pm8xxx-switch-away-from-using-chained-irq-h.patch mfd-qcom-pm8xxx-convert-to-platform-remove-callback-.patch mfd-qcom-pm8xxx-fix-of-populate-on-driver-rebind.patch diff --git a/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch b/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch deleted file mode 100644 index 3228e4184a..0000000000 --- a/queue-6.1/driver-core-enforce-device_lock-for-driver_match_dev.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 43fcab97a217ccdc2da2d8644f88398dc061e1e9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 14 Jan 2026 00:28:43 +0800 -Subject: driver core: enforce device_lock for driver_match_device() - -From: Gui-Dong Han - -[ Upstream commit dc23806a7c47ec5f1293aba407fb69519f976ee0 ] - -Currently, driver_match_device() is called from three sites. One site -(__device_attach_driver) holds device_lock(dev), but the other two -(bind_store and __driver_attach) do not. This inconsistency means that -bus match() callbacks are not guaranteed to be called with the lock -held. - -Fix this by introducing driver_match_device_locked(), which guarantees -holding the device lock using a scoped guard. Replace the unlocked calls -in bind_store() and __driver_attach() with this new helper. Also add a -lock assertion to driver_match_device() to enforce this guarantee. - -This consistency also fixes a known race condition. The driver_override -implementation relies on the device_lock, so the missing lock led to the -use-after-free (UAF) reported in Bugzilla for buses using this field. - -Stress testing the two newly locked paths for 24 hours with -CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP enabled showed no UAF recurrence -and no lockdep warnings. - -Cc: stable@vger.kernel.org -Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 -Suggested-by: Qiu-ji Chen -Signed-off-by: Gui-Dong Han -Fixes: 49b420a13ff9 ("driver core: check bus->match without holding device lock") -Reviewed-by: Danilo Krummrich -Reviewed-by: Greg Kroah-Hartman -Reviewed-by: Rafael J. Wysocki (Intel) -Link: https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Sasha Levin ---- - drivers/base/base.h | 9 +++++++++ - drivers/base/bus.c | 2 +- - drivers/base/dd.c | 2 +- - 3 files changed, 11 insertions(+), 2 deletions(-) - -diff --git a/drivers/base/base.h b/drivers/base/base.h -index 2a6cf004dedc3..4e06810efe3e0 100644 ---- a/drivers/base/base.h -+++ b/drivers/base/base.h -@@ -144,10 +144,19 @@ extern void device_set_deferred_probe_reason(const struct device *dev, - static inline int driver_match_device(struct device_driver *drv, - struct device *dev) - { -+ device_lock_assert(dev); -+ - return drv->bus->match ? drv->bus->match(dev, drv) : 1; - } - extern bool driver_allows_async_probing(struct device_driver *drv); - -+static inline int driver_match_device_locked(const struct device_driver *drv, -+ struct device *dev) -+{ -+ guard(device)(dev); -+ return driver_match_device(drv, dev); -+} -+ - static inline void dev_sync_state(struct device *dev) - { - if (dev->bus->sync_state) -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index 941532ddfdc68..78a64f2784d05 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -212,7 +212,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf, - int err = -ENODEV; - - dev = bus_find_device_by_name(bus, NULL, buf); -- if (dev && driver_match_device(drv, dev)) { -+ if (dev && driver_match_device_locked(drv, dev)) { - err = device_driver_attach(drv, dev); - if (!err) { - /* success */ -diff --git a/drivers/base/dd.c b/drivers/base/dd.c -index 6ad1b6eae65d6..02c846be7b174 100644 ---- a/drivers/base/dd.c -+++ b/drivers/base/dd.c -@@ -1175,7 +1175,7 @@ static int __driver_attach(struct device *dev, void *data) - * is an error. - */ - -- ret = driver_match_device(drv, dev); -+ ret = driver_match_device_locked(drv, dev); - if (ret == 0) { - /* no match */ - return 0; --- -2.51.0 - diff --git a/queue-6.1/series b/queue-6.1/series index 84c9edc52e..99ec6cce7c 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -41,7 +41,6 @@ bus-omap-ocp2scp-convert-to-platform-remove-callback.patch bus-omap-ocp2scp-fix-of-populate-on-driver-rebind.patch driver-core-make-state_synced-device-attribute-write.patch driver-core-add-a-guard-definition-for-the-device_lo.patch -driver-core-enforce-device_lock-for-driver_match_dev.patch ext4-make-ext4_es_remove_extent-return-void.patch ext4-get-rid-of-ppath-in-ext4_find_extent.patch ext4-get-rid-of-ppath-in-ext4_ext_create_new_leaf.patch