Re: [PATCH] drivers: core: Make dev->driver usage safe in dev_uevent()

[Greg Kroah-Hartman]

On Tue, Apr 30, 2024 at 06:55:31AM +0200, Dirk Behme wrote:
> Inspired by the function dev_driver_string() in the same file make sure
> in case of uninitialization dev->driver is used safely in dev_uevent(),
> as well.

I think you are racing and just getting "lucky" with your change here,
just like dev_driver_string() is doing there (that READ_ONCE() really
isn't doing much to protect you...)

> This change is based on the observation of the following race condition:
> 
> Thread #1:
> ==========
> 
> really_probe() {
> ...
> probe_failed:
> ...
> device_unbind_cleanup(dev) {
>       ...
>       dev->driver = NULL;   // <= Failed probe sets dev->driver to NULL
>       ...
>       }
> ...
> }
> 
> Thread #2:
> ==========
> 
> dev_uevent() {

Wait, how can dev_uevent() be called if probe fails?  Who is calling
that?

> ...
> if (dev->driver)
>       // If dev->driver is NULLed from really_probe() from here on,
>       // after above check, the system crashes
>       add_uevent_var(env, "DRIVER=%s", dev->driver->name);
> 
> dev_driver_string() can't be used here because we want NULL and not
> anything else in the non-init case.
> 
> Similar cases are reported by syzkaller in
> 
> https://syzkaller.appspot.com/bug?extid=ffa8143439596313a85a
> 
> But these are regarding the *initialization* of dev->driver
> 
> dev->driver = drv;
> 
> As this switches dev->driver to non-NULL these reports can be considered
> to be false-positives (which should be "fixed" by this commit, as well,
> though).
> 
> Fixes: 239378f16aa1 ("Driver core: add uevent vars for devices of a class")
> Cc: syzbot+ffa8143439596313a85a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Reviewed-by: Eugeniu Rosca <eugeniu.rosca@xxxxxxxxx>
> Tested-by: Eugeniu Rosca <eugeniu.rosca@xxxxxxxxx>
> Signed-off-by: Dirk Behme <dirk.behme@xxxxxxxxxxxx>
> ---
>  drivers/base/core.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 5f4e03336e68..99ead727c08f 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -2639,6 +2639,7 @@ static const char *dev_uevent_name(const struct kobject *kobj)
>  static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env)
>  {
>  	const struct device *dev = kobj_to_dev(kobj);
> +	struct device_driver *drv;
>  	int retval = 0;
>  
>  	/* add device node properties if present */
> @@ -2667,8 +2668,12 @@ static int dev_uevent(const struct kobject *kobj, struct kobj_uevent_env *env)
>  	if (dev->type && dev->type->name)
>  		add_uevent_var(env, "DEVTYPE=%s", dev->type->name);
>  
> -	if (dev->driver)
> -		add_uevent_var(env, "DRIVER=%s", dev->driver->name);
> +	/* dev->driver can change to NULL underneath us because of unbinding
> +	 * or failing probe(), so be careful about accessing it.
> +	 */
> +	drv = READ_ONCE(dev->driver);
> +	if (drv)
> +		add_uevent_var(env, "DRIVER=%s", drv->name);

Again, you are just reducing the window here.  Maybe a bit, but not all
that much overall as there is no real lock present.

So how is this actually solving anything?  And who is calling a uevent
on a device that is not probed properly?  Userspace?  Within the kernel?
Something else?

thanks,

greg k-h