On 10/21/2026 7:33 AM, Jiale Yao wrote: > VMBus dynamic IDs have two races with their sysfs add and remove paths. > > First, new_id_store() checks for an existing ID separately from inserting > the new entry, allowing concurrent writers to add duplicate GUIDs. Move the > check and insertion into one critical section. > > Second, matching returns a pointer into the dynamic ID list after dropping > the lock. A concurrent remove_id write can free that entry before probe uses > it. Copy the ID while holding the lock and reject probe when a dynamic ID is > removed between matching and probing. > > The series was found by static analysis and checked with checkpatch.pl. Each > patch was also checked individually and in series for application to the > base commit below. > > Jiale Yao (2): > Drivers: hv: vmbus: prevent duplicate dynamic IDs > Drivers: hv: vmbus: copy dynamic IDs before dropping the lock > > --- > Changes in v2: > - Split the dynamic ID insertion TOCTOU into a preparatory patch. > - Reject probe when the matching ID disappears before the second lookup. > - Preserve the ID-less hvsock probe path. > - Use scoped locking and memcpy() for the dynamic ID copy. > - Document that the device ID is valid only during probe. > - Cite the corresponding PCI and USB dynamic ID lifetime fixes. > - Add Cc: [email protected] and use the VMBus subject prefix. > > Link: https://lore.kernel.org/r/[email protected] > > drivers/hv/vmbus_drv.c | 56 +++++++++++++++++++++++++----------------- > include/linux/hyperv.h | 1 + > 2 files changed, 34 insertions(+), 23 deletions(-) > > > base-commit: a804c5742bff224d4cb4d25dd383554d598be32b
Performed regression testing in Azure. No issues detected. Tested-by: Kameron Carr <[email protected]> Besides the one NIT in PATCH 2/2, for the full series, Reviewed-by: Kameron Carr <[email protected]> -- Regards, Kameron
