cc34d77dd4
When a driver is probed through __driver_attach(), the bus' match()
callback is called without the device lock held, thus accessing the
driver_override field without a lock, which can cause a UAF.
Fix this by using the driver-core driver_override infrastructure taking
care of proper locking internally.
Note that calling match() from __driver_attach() without the device lock
held is intentional. [1]
Also note that we do not enable the driver_override feature of struct
bus_type, as SPI - in contrast to most other buses - passes "" to
sysfs_emit() when the driver_override pointer is NULL. Thus, printing
"\n" instead of "(null)\n".
Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1]
Reported-by: Gui-Dong Han <hanguidong02@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789
Fixes:
|
||
|---|---|---|
| .. | ||
| offload | ||
| ad7877.h | ||
| ads7846.h | ||
| altera.h | ||
| at73c213.h | ||
| corgi_lcd.h | ||
| ds1305.h | ||
| eeprom.h | ||
| flash.h | ||
| libertas_spi.h | ||
| max7301.h | ||
| mc33880.h | ||
| mmc_spi.h | ||
| mxs-spi.h | ||
| sh_hspi.h | ||
| sh_msiof.h | ||
| spi-fsl-dspi.h | ||
| spi-mem.h | ||
| spi.h | ||
| spi_bitbang.h | ||
| spi_gpio.h | ||
| spi_oc_tiny.h | ||
| tdo24m.h | ||
| tle62x0.h | ||
| xilinx_spi.h | ||