VMBUS devices still keep driver_override in bus-private storage. The sysfs write side updates that string through driver_set_override(), which replaces the pointer and frees the old value. However, driver_match_device() can call into hv_vmbus_get_id() from __driver_attach() without holding the device lock, and hv_vmbus_get_id() still dereferences that private pointer directly.
That means a bind/reprobe path can race with a concurrent driver_override update and make the match logic inspect freed memory. Switch vmbus to the driver-core driver_override infrastructure. This removes the private driver_override storage and uses device_match_driver_override() for the locked read in the match path. Keep the existing vmbus semantics intact: if driver_override matches but no dynamic or static device ID matches, continue to return the dummy vmbus_device_null ID so override-only binding still works as before. Link: https://lore.kernel.org/driver-core/[email protected]/ Fixes: d765edbb301c ("vmbus: add driver_override support") Cc: [email protected] Signed-off-by: Runyu Xiao <[email protected]> --- drivers/hv/vmbus_drv.c | 36 +++++------------------------------- include/linux/hyperv.h | 6 ------ 2 files changed, 5 insertions(+), 37 deletions(-) diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c index d28ff45d4cfd..a81e2b097636 100644 --- a/drivers/hv/vmbus_drv.c +++ b/drivers/hv/vmbus_drv.c @@ -538,34 +538,6 @@ static ssize_t device_show(struct device *dev, } static DEVICE_ATTR_RO(device); -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct hv_device *hv_dev = device_to_hv_device(dev); - int ret; - - ret = driver_set_override(dev, &hv_dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct hv_device *hv_dev = device_to_hv_device(dev); - ssize_t len; - - device_lock(dev); - len = sysfs_emit(buf, "%s\n", hv_dev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - /* Set up per device attributes in /sys/bus/vmbus/devices/<bus device> */ static struct attribute *vmbus_dev_attrs[] = { &dev_attr_id.attr, @@ -596,7 +568,6 @@ static struct attribute *vmbus_dev_attrs[] = { &dev_attr_channel_vp_mapping.attr, &dev_attr_vendor.attr, &dev_attr_device.attr, - &dev_attr_driver_override.attr, NULL, }; @@ -708,9 +679,11 @@ static const struct hv_vmbus_device_id *hv_vmbus_get_id(const struct hv_driver * { const guid_t *guid = &dev->dev_type; const struct hv_vmbus_device_id *id; + int ret; /* When driver_override is set, only bind to the matching driver */ - if (dev->driver_override && strcmp(dev->driver_override, drv->name)) + ret = device_match_driver_override(&dev->device, &drv->driver); + if (ret == 0) return NULL; /* Look at the dynamic ids first, before the static ones */ @@ -719,7 +692,7 @@ static const struct hv_vmbus_device_id *hv_vmbus_get_id(const struct hv_driver * id = hv_vmbus_dev_match(drv->id_table, guid); /* driver_override will always match, send a dummy id */ - if (!id && dev->driver_override) + if (!id && ret > 0) id = &vmbus_device_null; return id; @@ -1021,6 +994,7 @@ static const struct dev_pm_ops vmbus_pm = { /* The one and only one */ static const struct bus_type hv_bus = { .name = "vmbus", + .driver_override = true, .match = vmbus_match, .shutdown = vmbus_shutdown, .remove = vmbus_remove, diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h index 964f1be8150c..f9ede569602d 100644 --- a/include/linux/hyperv.h +++ b/include/linux/hyperv.h @@ -1272,12 +1272,6 @@ struct hv_device { u16 device_id; struct device device; - /* - * Driver name to force a match. Do not set directly, because core - * frees it. Use driver_set_override() to set or clear it. - */ - const char *driver_override; - struct vmbus_channel *channel; struct kset *channels_kset; struct device_dma_parameters dma_parms; -- 2.34.1
