| Message ID | 20260902170734.95504-6-djeffery@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | shut down devices asynchronously | expand |
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Incorrect condition ordering leads to a potential Use-After-Free of `dev->bus` during device shutdown. -- commit b894dd7ffd5113988601f8e495c49a29524ecb74 Author: David Jeffery <djeffery@redhat.com> driver core: do not always lock parent in shutdown This commit avoids unconditionally locking a parent device during device shutdown. It introduces __shutdown_one_device and updates shutdown_one_device to only acquire the parent lock when needed to prevent races with probe or release operations. > diff --git a/drivers/base/core.c b/drivers/base/core.c > index 7fe3fa6870a72..05285fae143d3 100644 > --- a/drivers/base/core.c > +++ b/drivers/base/core.c [ ... ] > @@ -4928,13 +4926,33 @@ static void shutdown_one_device(struct device *dev, struct device *parent) > dev_info(dev, "shutdown\n"); > dev->driver->shutdown(dev); > } > +} > > - device_unlock(dev); > - if (parent) > +static void shutdown_one_device(struct device *dev) > +{ > + struct device *parent; > + > + device_lock(dev); > + > + /* use parent lock if needed to avoid race with probe/release */ > + if (dev->bus && dev->bus->need_parent_lock && dev->p && !dev->p->dead && [Severity: High] Could this condition ordering lead to a use-after-free during device shutdown? If a module is unloaded concurrently with system shutdown, device_del() sets dev->p->dead to true and removes the device from the bus. Since device_shutdown() already incremented the device's refcount, the device structure is preserved. However, when the module finishes unloading, it unregisters the bus and frees the bus_type structure. Because of left-to-right evaluation in this if statement, dev->bus->need_parent_lock is accessed before checking !dev->p->dead. Would checking dev->p && !dev->p->dead before accessing bus properties prevent reading from the potentially unmapped bus structure? > + (parent = get_device(dev->parent))) { > + /* the parent lock needs to be acquired first, so re-lock */ > + device_unlock(dev); > + > + device_lock(parent); > + device_lock(dev); > + > + __shutdown_one_device(dev); > + device_unlock(dev); > device_unlock(parent); > + put_device(parent); > + } else { > + __shutdown_one_device(dev); > + device_unlock(dev); > + } > > put_device(dev); > - put_device(parent); > }
diff --git a/drivers/base/core.c b/drivers/base/core.c index 7fe3fa6870a7..05285fae143d 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -4903,12 +4903,10 @@ int device_change_owner(struct device *dev, kuid_t kuid, kgid_t kgid) return error; } -static void shutdown_one_device(struct device *dev, struct device *parent) +static void __shutdown_one_device(struct device *dev) { - /* hold lock to avoid race with probe/release */ - if (parent) - device_lock(parent); - device_lock(dev); + if (!dev->p || dev->p->dead) + return; /* Don't allow any more runtime suspends */ pm_runtime_get_noresume(dev); @@ -4928,13 +4926,33 @@ static void shutdown_one_device(struct device *dev, struct device *parent) dev_info(dev, "shutdown\n"); dev->driver->shutdown(dev); } +} - device_unlock(dev); - if (parent) +static void shutdown_one_device(struct device *dev) +{ + struct device *parent; + + device_lock(dev); + + /* use parent lock if needed to avoid race with probe/release */ + if (dev->bus && dev->bus->need_parent_lock && dev->p && !dev->p->dead && + (parent = get_device(dev->parent))) { + /* the parent lock needs to be acquired first, so re-lock */ + device_unlock(dev); + + device_lock(parent); + device_lock(dev); + + __shutdown_one_device(dev); + device_unlock(dev); device_unlock(parent); + put_device(parent); + } else { + __shutdown_one_device(dev); + device_unlock(dev); + } put_device(dev); - put_device(parent); } /** @@ -4942,7 +4960,7 @@ static void shutdown_one_device(struct device *dev, struct device *parent) */ void device_shutdown(void) { - struct device *dev, *parent; + struct device *dev; wait_for_device_probe(); device_block_probing(); @@ -4960,12 +4978,6 @@ void device_shutdown(void) dev = list_entry(devices_kset->list.prev, struct device, kobj.entry); - /* - * hold reference count of device's parent to - * prevent it from being freed because parent's - * lock is to be held - */ - parent = get_device(dev->parent); get_device(dev); /* * Make sure the device is off the kset list, in the @@ -4974,7 +4986,7 @@ void device_shutdown(void) list_del_init(&dev->kobj.entry); spin_unlock(&devices_kset->list_lock); - shutdown_one_device(dev, parent); + shutdown_one_device(dev); spin_lock(&devices_kset->list_lock); }