VMBus dynamic IDs have two races with their sysfs add and remove paths. First, new_id_store() checks for an existing ID separately from inserting the new entry, allowing concurrent writers to add duplicate GUIDs. Move the check and insertion into one critical section.
Second, matching returns a pointer into the dynamic ID list after dropping the lock. A concurrent remove_id write can free that entry before probe uses it. Copy the ID while holding the lock and reject probe when a dynamic ID is removed between matching and probing. The series was found by static analysis and checked with checkpatch.pl. Each patch was also checked individually and in series for application to the base commit below. Jiale Yao (2): Drivers: hv: vmbus: prevent duplicate dynamic IDs Drivers: hv: vmbus: copy dynamic IDs before dropping the lock --- Changes in v2: - Split the dynamic ID insertion TOCTOU into a preparatory patch. - Reject probe when the matching ID disappears before the second lookup. - Preserve the ID-less hvsock probe path. - Use scoped locking and memcpy() for the dynamic ID copy. - Document that the device ID is valid only during probe. - Cite the corresponding PCI and USB dynamic ID lifetime fixes. - Add Cc: [email protected] and use the VMBus subject prefix. Link: https://lore.kernel.org/r/[email protected] drivers/hv/vmbus_drv.c | 56 +++++++++++++++++++++++++----------------- include/linux/hyperv.h | 1 + 2 files changed, 34 insertions(+), 23 deletions(-) base-commit: a804c5742bff224d4cb4d25dd383554d598be32b -- 2.34.1
