linux/drivers/base
Dirk Behme c0a40097f0 drivers: core: synchronize really_probe() and dev_uevent()
Synchronize the dev->driver usage in really_probe() and dev_uevent().
These can run in different threads, what can result in the following
race condition for dev->driver uninitialization:

Thread #1:
==========

really_probe() {
...
probe_failed:
...
device_unbind_cleanup(dev) {
    ...
    dev->driver = NULL;   // <= Failed probe sets dev->driver to NULL
    ...
    }
...
}

Thread #2:
==========

dev_uevent() {
...
if (dev->driver)
      // If dev->driver is NULLed from really_probe() from here on,
      // after above check, the system crashes
      add_uevent_var(env, "DRIVER=%s", dev->driver->name);
...
}

really_probe() holds the lock, already. So nothing needs to be done
there. dev_uevent() is called with lock held, often, too. But not
always. What implies that we can't add any locking in dev_uevent()
itself. So fix this race by adding the lock to the non-protected
path. This is the path where above race is observed:

 dev_uevent+0x235/0x380
 uevent_show+0x10c/0x1f0  <= Add lock here
 dev_attr_show+0x3a/0xa0
 sysfs_kf_seq_show+0x17c/0x250
 kernfs_seq_show+0x7c/0x90
 seq_read_iter+0x2d7/0x940
 kernfs_fop_read_iter+0xc6/0x310
 vfs_read+0x5bc/0x6b0
 ksys_read+0xeb/0x1b0
 __x64_sys_read+0x42/0x50
 x64_sys_call+0x27ad/0x2d30
 do_syscall_64+0xcd/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Similar cases are reported by syzkaller in

https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a

But these are regarding the *initialization* of dev->driver

dev->driver = drv;

As this switches dev->driver to non-NULL these reports can be considered
to be false-positives (which should be "fixed" by this commit, as well,
though).

The same issue was reported and tried to be fixed back in 2015 in

https://lore.kernel.org/lkml/1421259054-2574-1-git-send-email-a.sangwan@samsung.com/

already.

Fixes: 239378f16a ("Driver core: add uevent vars for devices of a class")
Cc: stable <stable@kernel.org>
Cc: syzbot+ffa8143439596313a85a@syzkaller.appspotmail.com
Cc: Ashish Sangwan <a.sangwan@samsung.com>
Cc: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Dirk Behme <dirk.behme@de.bosch.com>
Link: https://lore.kernel.org/r/20240513050634.3964461-1-dirk.behme@de.bosch.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-06-04 18:14:51 +02:00
..
firmware_loader firmware_loader: Suppress warning on FW_OPT_NO_WARN flag 2024-03-07 22:05:09 +00:00
power PM: sleep: Take advantage of %ps to simplify debug output 2024-04-08 17:08:00 +02:00
regmap regmap-i2c: Subtract reg size from max_write 2024-05-27 01:30:33 +01:00
test drivers: base: test: Make property entry API test modular 2023-10-05 13:11:44 +02:00
arch_numa.c arm64: irq: set the correct node for VMAP stack 2023-12-05 14:26:50 +00:00
arch_topology.c arch/topology: Fix variable naming to avoid shadowing 2024-05-15 10:22:16 +02:00
attribute_container.c
auxiliary.c driver core: mark remaining local bus_type variables as const 2023-12-21 13:56:30 +01:00
base.h module: don't ignore sysfs_create_link() failures 2024-04-11 14:42:08 +02:00
bus.c module: don't ignore sysfs_create_link() failures 2024-04-11 14:42:08 +02:00
cacheinfo.c mm and cache_info: remove unnecessary CPU cache info update 2024-02-22 10:24:41 -08:00
class.c class: fix use-after-free in class_register() 2024-01-04 17:13:04 +01:00
component.c driver core: component: fix spellos 2024-01-30 15:58:06 -08:00
container.c driver core: container: make container_subsys const 2023-12-21 13:56:10 +01:00
core.c drivers: core: synchronize really_probe() and dev_uevent() 2024-06-04 18:14:51 +02:00
cpu.c crash: add a new kexec flag for hotplug support 2024-04-23 14:59:01 +10:00
dd.c device: core: Log warning for devices pending deferred probe on timeout 2024-03-07 22:10:31 +00:00
devcoredump.c devcoredump: Add dev_coredump_put() 2024-04-11 09:39:48 -04:00
devres.c drivers/base: use ARCH_DMA_MINALIGN instead of ARCH_KMALLOC_MINALIGN 2023-06-19 16:19:20 -07:00
devtmpfs.c driver core: clean up the logic to determine which /sys/dev/ directory to use 2023-03-31 17:45:07 +02:00
driver.c driver core: create bus_is_registered() 2023-02-09 10:43:35 +01:00
firmware.c
hypervisor.c
init.c drivers: base: Move cpu_dev_init() after node_dev_init() 2023-12-06 12:41:49 +09:00
isa.c driver core: mark remaining local bus_type variables as const 2023-12-21 13:56:30 +01:00
Kconfig driver core: Add CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT 2023-03-28 18:45:59 +02:00
Makefile genirq: Get rid of GENERIC_MSI_IRQ_DOMAIN 2022-11-17 15:15:20 +01:00
map.c
memory.c crash: add a new kexec flag for hotplug support 2024-04-23 14:59:01 +10:00
module.c module: don't ignore sysfs_create_link() failures 2024-04-11 14:42:08 +02:00
node.c cxl/region: Deal with numa nodes not enumerated by SRAT 2024-03-12 14:54:03 -07:00
physical_location.c driver core: location: Free struct acpi_pld_info *pld before return false 2023-01-20 14:20:30 +01:00
physical_location.h driver core: physical_location.h remove extern from function prototypes 2023-03-24 15:35:48 +01:00
pinctrl.c
platform-msi.c Driver core changes for 6.9-rc1 2024-03-21 13:34:15 -07:00
platform.c driver core: platform: Annotate struct irq_affinity_devres with __counted_by 2023-10-07 18:13:09 +02:00
property.c Char/Misc and other driver subsystem changes for 6.10-rc1 2024-05-22 12:26:46 -07:00
soc.c driver core: mark remaining local bus_type variables as const 2023-12-21 13:56:30 +01:00
swnode.c device property: Don't use "proxy" headers 2024-03-07 22:07:26 +00:00
syscore.c
topology.c drivers/base: fix userspace break from using bin_attributes for cpumap and cpulist 2022-07-15 17:36:33 +02:00
trace.c
trace.h tracing/treewide: Remove second parameter of __assign_str() 2024-05-22 20:14:47 -04:00
transport_class.c drivers: base: transport_class: fix resource leak when transport_add_device() fails 2023-01-20 14:22:53 +01:00