From: Greg Kroah-Hartman Date: Mon, 15 Jun 2026 16:55:47 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fb7b1b42e3239f7e33ae740ab4e510fd1f952890;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: driver-core-faux-fix-root-device-registration.patch driver-core-reject-devices-with-unregistered-buses.patch --- diff --git a/queue-7.1/driver-core-faux-fix-root-device-registration.patch b/queue-7.1/driver-core-faux-fix-root-device-registration.patch new file mode 100644 index 0000000000..2978413e3b --- /dev/null +++ b/queue-7.1/driver-core-faux-fix-root-device-registration.patch @@ -0,0 +1,83 @@ +From 580a795105dae2ef1622df72a27a8fb0605e2f6b Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Fri, 24 Apr 2026 17:31:26 +0200 +Subject: driver core: faux: fix root device registration + +From: Johan Hovold + +commit 580a795105dae2ef1622df72a27a8fb0605e2f6b upstream. + +A recent change made the faux bus root device be allocated dynamically +but failed to provide a release function to free the memory when the +last reference is dropped (on theoretical failure to register the device +or bus). + +Fix this by using root_device_register() instead of open coding. + +Also add the missing sanity check when registering faux devices to avoid +use-after-free if the bus failed to register (which would previously +have triggered a bunch of use-after-free warnings). + +Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device") +Cc: stable@vger.kernel.org # 7.0 +Cc: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260424153127.2647405-2-johan@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/faux.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/base/faux.c ++++ b/drivers/base/faux.c +@@ -133,6 +133,9 @@ struct faux_device *faux_device_create_w + struct device *dev; + int ret; + ++ if (!faux_bus_root) ++ return NULL; ++ + faux_obj = kzalloc_obj(*faux_obj); + if (!faux_obj) + return NULL; +@@ -232,19 +235,12 @@ EXPORT_SYMBOL_GPL(faux_device_destroy); + + int __init faux_bus_init(void) + { ++ struct device *root; + int ret; + +- faux_bus_root = kzalloc_obj(*faux_bus_root); +- if (!faux_bus_root) +- return -ENOMEM; +- +- dev_set_name(faux_bus_root, "faux"); +- +- ret = device_register(faux_bus_root); +- if (ret) { +- put_device(faux_bus_root); +- return ret; +- } ++ root = root_device_register("faux"); ++ if (IS_ERR(root)) ++ return PTR_ERR(root); + + ret = bus_register(&faux_bus_type); + if (ret) +@@ -254,12 +250,14 @@ int __init faux_bus_init(void) + if (ret) + goto error_driver; + ++ faux_bus_root = root; ++ + return ret; + + error_driver: + bus_unregister(&faux_bus_type); + + error_bus: +- device_unregister(faux_bus_root); ++ root_device_unregister(root); + return ret; + } diff --git a/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch b/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch new file mode 100644 index 0000000000..3bb7114801 --- /dev/null +++ b/queue-7.1/driver-core-reject-devices-with-unregistered-buses.patch @@ -0,0 +1,62 @@ +From 36f35b8df6972167102a1c3d4361e0afb6a84534 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 30 Apr 2026 11:17:18 +0200 +Subject: driver core: reject devices with unregistered buses + +From: Johan Hovold + +commit 36f35b8df6972167102a1c3d4361e0afb6a84534 upstream. + +Trying to register a device on a bus which has not yet been registered +used to trigger a NULL-pointer dereference, but since the const bus +structure rework registration instead succeeds without the device being +added to the bus. + +This specifically means that the device will never bind to a driver and +that the bus sysfs attributes are not created (i.e. as if the device had +no bus). + +Reject devices with unregistered buses to catch any callers that get +the ordering wrong and to handle bus registration failures more +gracefully. + +Fixes: 5221b82d46f2 ("driver core: bus: bus_add/probe/remove_device() cleanups") +Cc: stable@vger.kernel.org # 6.3 +Cc: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Link: https://patch.msgid.link/20260430091718.230228-1-johan@kernel.org +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/bus.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -544,10 +544,10 @@ static const struct attribute_group driv + */ + int bus_add_device(struct device *dev) + { +- struct subsys_private *sp = bus_to_subsys(dev->bus); ++ struct subsys_private *sp; + int error; + +- if (!sp) { ++ if (!dev->bus) { + /* + * This is a normal operation for many devices that do not + * have a bus assigned to them, just say that all went +@@ -556,6 +556,13 @@ int bus_add_device(struct device *dev) + return 0; + } + ++ sp = bus_to_subsys(dev->bus); ++ if (!sp) { ++ pr_err("%s: cannot add device '%s' to unregistered bus '%s'\n", ++ __func__, dev_name(dev), dev->bus->name); ++ return -EINVAL; ++ } ++ + /* + * Reference in sp is now incremented and will be dropped when + * the device is removed from the bus diff --git a/queue-7.1/series b/queue-7.1/series index a9e2d904a7..a99e2ae379 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1 +1,3 @@ fs-fcntl-fix-softirq-unsafe-lock-order-in-fasync-signaling.patch +driver-core-faux-fix-root-device-registration.patch +driver-core-reject-devices-with-unregistered-buses.patch