driver core: fix potential NULL pointer dereference in dev_uevent()
authorDmitry Torokhov <dmitry.torokhov@gmail.com>
Tue, 11 Mar 2025 05:24:16 +0000 (22:24 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 15 Apr 2025 15:04:35 +0000 (17:04 +0200)
commit18daa52418e7e4629ed1703b64777294209d2622
tree8039b3bc6b139d7e1aa53387cf89c3f1842050d0
parent04d3e5461c1f5cf8eec964ab64948ebed826e95e
driver core: fix potential NULL pointer dereference in dev_uevent()

If userspace reads "uevent" device attribute at the same time as another
threads unbinds the device from its driver, change to dev->driver from a
valid pointer to NULL may result in crash. Fix this by using READ_ONCE()
when fetching the pointer, and take bus' drivers klist lock to make sure
driver instance will not disappear while we access it.

Use WRITE_ONCE() when setting the driver pointer to ensure there is no
tearing.

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://lore.kernel.org/r/20250311052417.1846985-3-dmitry.torokhov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/base/base.h
drivers/base/bus.c
drivers/base/core.c