Skip to content

driver core: parent lock fixes

Johan Hovold driver-core linux-usb lkml stable 1 version Applied

Status from this message: Applied, thanks!

Get series with b4
b4 am [email protected]

Versions newest first

  1. v2 Latest3 patches 6 repliesApplied

Changes in v2 from the cover letter

- fix the parent lock UAF issue (new patch)
- include my update of Mario's fix as it also depends on the UAF fix [1]

[1] https://lore.kernel.org/all/[email protected]/

Patches in v2 Applied

#Subject and filesSizeRepliesApplied
1/3driver core: fix parent lock use-after-free on USB disconnectdrivers/base/bus.c drivers/base/dd.c drivers/usb/core/driver.c +3 more+10 -82 replies
2/3driver core: take parent lock on deferred probedrivers/base/base.h drivers/base/bus.c drivers/base/dd.c+26 -100 replies
3/3driver core: take parent lock in async device attachdrivers/base/dd.c+47 -382 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v2 yet.

Read the v2 thread

Cover letter [PATCH v2 0/3] driver core: parent lock fixes

Mario Peter reported that USB interfaces may be probed without holding the parent USB device lock during asynchronous and deferred probe.

This series addresses both cases, while fixing a long-standing use-after-free issue with the parent lock implementation stemming from the fact that the driver core does not necessarily hold a reference to the parent device when taking its lock.

Johan

Changes in v2:
- fix the parent lock UAF issue (new patch)
- include my update of Mario's fix as it also depends on the UAF fix [1]

[1] https://lore.kernel.org/all/[email protected]/

Johan Hovold (2):
driver core: fix parent lock use-after-free on USB disconnect driver core: take parent lock on deferred probe

Mario Peter (1):
driver core: take parent lock in async device attach

 drivers/base/base.h        |  1 +
 drivers/base/bus.c         | 32 +++++++++----
 drivers/base/dd.c          | 92 +++++++++++++++++++++-----------------
 drivers/usb/core/driver.c  |  1 -
 drivers/usb/core/message.c |  1 +
 include/linux/device.h     |  5 +++
 include/linux/device/bus.h |  3 --
 7 files changed, 81 insertions(+), 54 deletions(-)
Signature · 1 line
2.55.0