Patch "bus: fsl-mc: fix use-after-free in driver_override_show()" has been added to the 5.10-stable tree

DISCUSSION Gui-Dong Han 1 participant 1 message Mar 9 1 message not in the archive Stable branch

lore

Share & tools

lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Gui-Dong Han

author

2026-03-09 02:30 UTC #1 lore raw

Quoted 8 lines · Sasha Levin

This is a note to let you know that I've just added the patch titled
bus: fsl-mc: fix use-after-free in driver_override_show()
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

Quoted 6 lines

The filename of the patch is:
bus-fsl-mc-fix-use-after-free-in-driver_override_sho.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Hi Sasha,

It seems you might have missed Fedor's earlier reminder regarding this patch [1].

We still need to backport commit 5688f212e98a ("fsl-mc: Use driver_set_override() instead of open-coding") [2] to 5.10.y and 5.15.y.

Without that prerequisite commit, driver_override_store() in these older kernels doesn't hold device_lock() at all. This means not only does the original use-after-free race remain, but concurrent store() calls can actually trigger a double free, which is a more severe issue.

Could you please queue 5688f212e98a for the 5.10 and 5.15 stable trees as well?

Thanks.

[1] https://lore.kernel.org/stable/20260214220547-5519e7b20a4919ddd81d97c3-pchelkin@ispras/
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5688f212e98a

Quoted 47 lines

commit 09d8eb1f3a01b0d27891a7964da1126b4cba842e
Author: Gui-Dong Han <[email protected]>
Date:   Wed Dec 3 01:44:38 2025 +0800
bus: fsl-mc: fix use-after-free in driver_override_show()
[ Upstream commit 148891e95014b5dc5878acefa57f1940c281c431 ]
The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock.
This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function.
Fix this by holding the device_lock around the read operation.
Fixes 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus")
Cc [email protected]
Signed-off-by Gui-Dong Han <[email protected]>
Reviewed-by Ioana Ciornei <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
Signed-off-by Christophe Leroy (CS GROUP) <[email protected]>
Signed-off-by Sasha Levin <[email protected]>
drivers/bus/fsl-mc/fsl-mc-bus.c +5 -1
index 8f7448da9258d..49eaf5bddd5ad 100644
@@ -194,8 +194,12 @@ static ssize_t driver_override_show(struct device *dev,
                                    struct device_attribute *attr, char *buf)
 {
        struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
+       ssize_t len;
 
-       return sysfs_emit(buf, "%s\n", mc_dev->driver_override);
+       device_lock(dev);
+       len = sysfs_emit(buf, "%s\n", mc_dev->driver_override);
+       device_unlock(dev);
+       return len;
 }
 static DEVICE_ATTR_RW(driver_override);
 