From: Danilo Krummrich <dakr@kernel•org>
To: "Russell King" <linux@armlinux•org.uk>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation•org>,
"Rafael J. Wysocki" <rafael@kernel•org>,
"Ioana Ciornei" <ioana.ciornei@nxp•com>,
"Nipun Gupta" <nipun.gupta@amd•com>,
"Nikhil Agarwal" <nikhil.agarwal@amd•com>,
"K. Y. Srinivasan" <kys@microsoft•com>,
"Haiyang Zhang" <haiyangz@microsoft•com>,
"Wei Liu" <wei.liu@kernel•org>,
"Dexuan Cui" <decui@microsoft•com>,
"Long Li" <longli@microsoft•com>,
"Bjorn Helgaas" <bhelgaas@google•com>,
"Armin Wolf" <W_Armin@gmx•de>,
"Bjorn Andersson" <andersson@kernel•org>,
"Mathieu Poirier" <mathieu.poirier@linaro•org>,
"Vineeth Vijayan" <vneethv@linux•ibm.com>,
"Peter Oberparleiter" <oberpar@linux•ibm.com>,
"Heiko Carstens" <hca@linux•ibm.com>,
"Vasily Gorbik" <gor@linux•ibm.com>,
"Alexander Gordeev" <agordeev@linux•ibm.com>,
"Christian Borntraeger" <borntraeger@linux•ibm.com>,
"Sven Schnelle" <svens@linux•ibm.com>,
"Harald Freudenberger" <freude@linux•ibm.com>,
"Holger Dengler" <dengler@linux•ibm.com>,
"Mark Brown" <broonie@kernel•org>,
"Michael S. Tsirkin" <mst@redhat•com>,
"Jason Wang" <jasowang@redhat•com>,
"Xuan Zhuo" <xuanzhuo@linux•alibaba.com>,
"Eugenio Pérez" <eperezma@redhat•com>,
"Alex Williamson" <alex@shazbot•org>,
"Juergen Gross" <jgross@suse•com>,
"Stefano Stabellini" <sstabellini@kernel•org>,
"Oleksandr Tyshchenko" <oleksandr_tyshchenko@epam•com>,
"Christophe Leroy (CS GROUP)" <chleroy@kernel•org>
Cc: linux-kernel@vger•kernel.org, driver-core@lists•linux.dev,
linuxppc-dev@lists•ozlabs.org, linux-hyperv@vger•kernel.org,
linux-pci@vger•kernel.org, platform-driver-x86@vger•kernel.org,
linux-arm-msm@vger•kernel.org, linux-remoteproc@vger•kernel.org,
linux-s390@vger•kernel.org, linux-spi@vger•kernel.org,
virtualization@lists•linux.dev, kvm@vger•kernel.org,
xen-devel@lists•xenproject.org,
linux-arm-kernel@lists•infradead.org,
Danilo Krummrich <dakr@kernel•org>
Subject: [PATCH 10/12] s390/ap: use generic driver_override infrastructure
Date: Tue, 24 Mar 2026 01:59:14 +0100 [thread overview]
Message-ID: <20260324005919.2408620-11-dakr@kernel.org> (raw)
In-Reply-To: <20260324005919.2408620-1-dakr@kernel.org>
When the AP masks are updated via apmask_store() or aqmask_store(),
ap_bus_revise_bindings() is called after ap_attr_mutex has been
released.
This calls __ap_revise_reserved(), which accesses the driver_override
field without holding any lock, racing against a concurrent
driver_override_store() that may free the old string, resulting in a
potential UAF.
Fix this by using the driver-core driver_override infrastructure, which
protects all accesses with an internal spinlock.
Note that unlike most other buses, the AP bus does not check
driver_override in its match() callback; the override is checked in
ap_device_probe() and __ap_revise_reserved() instead.
Also note that we do not enable the driver_override feature of struct
bus_type, as AP - in contrast to most other buses - passes "" to
sysfs_emit() when the driver_override pointer is NULL. Thus, printing
"\n" instead of "(null)\n".
Additionally, AP has a custom counter that is modified in the
corresponding custom driver_override_store().
Fixes: d38a87d7c064 ("s390/ap: Support driver_override for AP queue devices")
Signed-off-by: Danilo Krummrich <dakr@kernel•org>
---
drivers/s390/crypto/ap_bus.c | 34 +++++++++++++++++-----------------
drivers/s390/crypto/ap_bus.h | 1 -
drivers/s390/crypto/ap_queue.c | 24 ++++++------------------
3 files changed, 23 insertions(+), 36 deletions(-)
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index d652df96a507..f24e27add721 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -859,25 +859,24 @@ static int __ap_queue_devices_with_id_unregister(struct device *dev, void *data)
static int __ap_revise_reserved(struct device *dev, void *dummy)
{
- int rc, card, queue, devres, drvres;
+ int rc, card, queue, devres, drvres, ovrd;
if (is_queue_dev(dev)) {
struct ap_driver *ap_drv = to_ap_drv(dev->driver);
struct ap_queue *aq = to_ap_queue(dev);
- struct ap_device *ap_dev = &aq->ap_dev;
card = AP_QID_CARD(aq->qid);
queue = AP_QID_QUEUE(aq->qid);
- if (ap_dev->driver_override) {
- if (strcmp(ap_dev->driver_override,
- ap_drv->driver.name)) {
- pr_debug("reprobing queue=%02x.%04x\n", card, queue);
- rc = device_reprobe(dev);
- if (rc) {
- AP_DBF_WARN("%s reprobing queue=%02x.%04x failed\n",
- __func__, card, queue);
- }
+ ovrd = device_match_driver_override(dev, &ap_drv->driver);
+ if (ovrd > 0) {
+ /* override set and matches, nothing to do */
+ } else if (ovrd == 0) {
+ pr_debug("reprobing queue=%02x.%04x\n", card, queue);
+ rc = device_reprobe(dev);
+ if (rc) {
+ AP_DBF_WARN("%s reprobing queue=%02x.%04x failed\n",
+ __func__, card, queue);
}
} else {
mutex_lock(&ap_attr_mutex);
@@ -928,7 +927,7 @@ int ap_owned_by_def_drv(int card, int queue)
if (aq) {
const struct device_driver *drv = aq->ap_dev.device.driver;
const struct ap_driver *ap_drv = to_ap_drv(drv);
- bool override = !!aq->ap_dev.driver_override;
+ bool override = device_has_driver_override(&aq->ap_dev.device);
if (override && drv && ap_drv->flags & AP_DRIVER_FLAG_DEFAULT)
rc = 1;
@@ -977,7 +976,7 @@ static int ap_device_probe(struct device *dev)
{
struct ap_device *ap_dev = to_ap_dev(dev);
struct ap_driver *ap_drv = to_ap_drv(dev->driver);
- int card, queue, devres, drvres, rc = -ENODEV;
+ int card, queue, devres, drvres, rc = -ENODEV, ovrd;
if (!get_device(dev))
return rc;
@@ -991,10 +990,11 @@ static int ap_device_probe(struct device *dev)
*/
card = AP_QID_CARD(to_ap_queue(dev)->qid);
queue = AP_QID_QUEUE(to_ap_queue(dev)->qid);
- if (ap_dev->driver_override) {
- if (strcmp(ap_dev->driver_override,
- ap_drv->driver.name))
- goto out;
+ ovrd = device_match_driver_override(dev, &ap_drv->driver);
+ if (ovrd > 0) {
+ /* override set and matches, nothing to do */
+ } else if (ovrd == 0) {
+ goto out;
} else {
mutex_lock(&ap_attr_mutex);
devres = test_bit_inv(card, ap_perms.apm) &&
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 51e08f27bd75..04ea256ecf91 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -166,7 +166,6 @@ void ap_driver_unregister(struct ap_driver *);
struct ap_device {
struct device device;
int device_type; /* AP device type. */
- const char *driver_override;
};
#define to_ap_dev(x) container_of((x), struct ap_device, device)
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 3fe2e41c5c6b..ca9819e6f7e7 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -734,26 +734,14 @@ static ssize_t driver_override_show(struct device *dev,
struct device_attribute *attr,
char *buf)
{
- struct ap_queue *aq = to_ap_queue(dev);
- struct ap_device *ap_dev = &aq->ap_dev;
- int rc;
-
- device_lock(dev);
- if (ap_dev->driver_override)
- rc = sysfs_emit(buf, "%s\n", ap_dev->driver_override);
- else
- rc = sysfs_emit(buf, "\n");
- device_unlock(dev);
-
- return rc;
+ guard(spinlock)(&dev->driver_override.lock);
+ return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: "");
}
static ssize_t driver_override_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
- struct ap_queue *aq = to_ap_queue(dev);
- struct ap_device *ap_dev = &aq->ap_dev;
int rc = -EINVAL;
bool old_value;
@@ -764,13 +752,13 @@ static ssize_t driver_override_store(struct device *dev,
if (ap_apmask_aqmask_in_use)
goto out;
- old_value = ap_dev->driver_override ? true : false;
- rc = driver_set_override(dev, &ap_dev->driver_override, buf, count);
+ old_value = device_has_driver_override(dev);
+ rc = __device_set_driver_override(dev, buf, count);
if (rc)
goto out;
- if (old_value && !ap_dev->driver_override)
+ if (old_value && !device_has_driver_override(dev))
--ap_driver_override_ctr;
- else if (!old_value && ap_dev->driver_override)
+ else if (!old_value && device_has_driver_override(dev))
++ap_driver_override_ctr;
rc = count;
--
2.53.0
next prev parent reply other threads:[~2026-03-24 1:01 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 0:59 [PATCH 00/12] treewide: Convert buses to use generic driver_override Danilo Krummrich
2026-03-24 0:59 ` [PATCH 01/12] amba: use generic driver_override infrastructure Danilo Krummrich
2026-03-24 0:59 ` [PATCH 02/12] bus: fsl-mc: " Danilo Krummrich
2026-03-25 12:01 ` Ioana Ciornei
2026-03-28 12:10 ` Christophe Leroy (CS GROUP)
2026-04-04 16:56 ` Christophe Leroy (CS GROUP)
2026-03-24 0:59 ` [PATCH 03/12] cdx: " Danilo Krummrich
2026-03-24 0:59 ` [PATCH 04/12] hv: vmbus: " Danilo Krummrich
2026-03-25 17:28 ` Michael Kelley
2026-04-04 15:01 ` [PATCH v2] Drivers: " Danilo Krummrich
2026-03-24 0:59 ` [PATCH 05/12] PCI: " Danilo Krummrich
2026-03-25 3:08 ` Gui-Dong Han
2026-03-26 18:08 ` Bjorn Helgaas
2026-03-30 16:28 ` Danilo Krummrich
2026-03-30 17:38 ` Danilo Krummrich
2026-03-30 20:10 ` Alex Williamson
2026-03-31 8:06 ` Danilo Krummrich
2026-03-31 8:22 ` Danilo Krummrich
2026-03-31 19:18 ` Alex Williamson
2026-03-24 0:59 ` [PATCH 06/12] platform/wmi: " Danilo Krummrich
2026-03-24 19:41 ` Armin Wolf
2026-03-31 15:02 ` Ilpo Järvinen
2026-03-31 15:43 ` Danilo Krummrich
2026-03-31 15:50 ` Ilpo Järvinen
2026-03-24 0:59 ` [PATCH 07/12] rpmsg: " Danilo Krummrich
2026-03-25 15:49 ` Mathieu Poirier
2026-03-24 0:59 ` [PATCH 08/12] vdpa: " Danilo Krummrich
2026-03-25 10:17 ` Eugenio Perez Martin
2026-03-24 0:59 ` [PATCH 09/12] s390/cio: " Danilo Krummrich
2026-03-26 9:43 ` Vineeth Vijayan
2026-03-24 0:59 ` Danilo Krummrich [this message]
2026-03-24 12:41 ` [PATCH 10/12] s390/ap: " Harald Freudenberger
2026-03-24 12:58 ` Holger Dengler
2026-03-24 0:59 ` [PATCH 11/12] spi: " Danilo Krummrich
2026-03-24 0:59 ` [PATCH 12/12] driver core: remove driver_set_override() Danilo Krummrich
2026-03-24 8:09 ` Greg Kroah-Hartman
2026-03-24 15:00 ` (subset) [PATCH 00/12] treewide: Convert buses to use generic driver_override Mark Brown
2026-03-25 9:29 ` Michael S. Tsirkin
2026-03-26 17:38 ` Danilo Krummrich
2026-04-04 15:07 ` (subset) " Danilo Krummrich
2026-04-04 16:58 ` Christophe Leroy (CS GROUP)
2026-04-04 17:04 ` Danilo Krummrich
2026-04-04 17:09 ` Christophe Leroy (CS GROUP)
2026-04-04 19:20 ` Danilo Krummrich
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260324005919.2408620-11-dakr@kernel.org \
--to=dakr@kernel$(echo .)org \
--cc=W_Armin@gmx$(echo .)de \
--cc=agordeev@linux$(echo .)ibm.com \
--cc=alex@shazbot$(echo .)org \
--cc=andersson@kernel$(echo .)org \
--cc=bhelgaas@google$(echo .)com \
--cc=borntraeger@linux$(echo .)ibm.com \
--cc=broonie@kernel$(echo .)org \
--cc=chleroy@kernel$(echo .)org \
--cc=decui@microsoft$(echo .)com \
--cc=dengler@linux$(echo .)ibm.com \
--cc=driver-core@lists$(echo .)linux.dev \
--cc=eperezma@redhat$(echo .)com \
--cc=freude@linux$(echo .)ibm.com \
--cc=gor@linux$(echo .)ibm.com \
--cc=gregkh@linuxfoundation$(echo .)org \
--cc=haiyangz@microsoft$(echo .)com \
--cc=hca@linux$(echo .)ibm.com \
--cc=ioana.ciornei@nxp$(echo .)com \
--cc=jasowang@redhat$(echo .)com \
--cc=jgross@suse$(echo .)com \
--cc=kvm@vger$(echo .)kernel.org \
--cc=kys@microsoft$(echo .)com \
--cc=linux-arm-kernel@lists$(echo .)infradead.org \
--cc=linux-arm-msm@vger$(echo .)kernel.org \
--cc=linux-hyperv@vger$(echo .)kernel.org \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=linux-pci@vger$(echo .)kernel.org \
--cc=linux-remoteproc@vger$(echo .)kernel.org \
--cc=linux-s390@vger$(echo .)kernel.org \
--cc=linux-spi@vger$(echo .)kernel.org \
--cc=linux@armlinux$(echo .)org.uk \
--cc=linuxppc-dev@lists$(echo .)ozlabs.org \
--cc=longli@microsoft$(echo .)com \
--cc=mathieu.poirier@linaro$(echo .)org \
--cc=mst@redhat$(echo .)com \
--cc=nikhil.agarwal@amd$(echo .)com \
--cc=nipun.gupta@amd$(echo .)com \
--cc=oberpar@linux$(echo .)ibm.com \
--cc=oleksandr_tyshchenko@epam$(echo .)com \
--cc=platform-driver-x86@vger$(echo .)kernel.org \
--cc=rafael@kernel$(echo .)org \
--cc=sstabellini@kernel$(echo .)org \
--cc=svens@linux$(echo .)ibm.com \
--cc=virtualization@lists$(echo .)linux.dev \
--cc=vneethv@linux$(echo .)ibm.com \
--cc=wei.liu@kernel$(echo .)org \
--cc=xen-devel@lists$(echo .)xenproject.org \
--cc=xuanzhuo@linux$(echo .)alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox