[PATCH v3 0/2] Drivers: hv: vmbus: fix dynamic ID races

[Jiale Yao]

VMBus dynamic IDs have two races with their sysfs add and remove paths.

First, new_id_store() checks for an existing ID separately from inserting
the new entry, allowing concurrent writers to add duplicate GUIDs. Move the
check and insertion into one critical section.

Second, matching returns a pointer into the dynamic ID list after dropping
the lock. A concurrent remove_id write can free that entry before probe uses
it. Copy the ID while holding the lock and reject probe when a dynamic ID is
removed between matching and probing.

The series was found by static analysis. It has been regression tested in
Azure by Kameron Carr.

Changes in v3:
- Keep the original declaration order in vmbus_probe().
- Add Kameron Carr's Tested-by and Reviewed-by tags.

Changes in v2:
- Split the dynamic ID insertion TOCTOU into a preparatory patch.
- Reject probe when the matching ID disappears before the second lookup.
- Preserve the ID-less hvsock probe path.
- Use scoped locking and memcpy() for the dynamic ID copy.
- Document that the device ID is valid only during probe.
- Cite the corresponding PCI and USB dynamic ID lifetime fixes.
- Add Cc: stable@xxxxxxxxxxxxxxx and use the VMBus subject prefix.

Link: https://lore.kernel.org/r/20261021143323.338146-1-yaojiale02@xxxxxxx
Link: https://lore.kernel.org/r/20261019085544.1834700-1-yaojiale02@xxxxxxx

Jiale Yao (2):
  Drivers: hv: vmbus: prevent duplicate dynamic IDs
  Drivers: hv: vmbus: copy dynamic IDs before dropping the lock

 drivers/hv/vmbus_drv.c | 52 +++++++++++++++++++++++++-----------------
 include/linux/hyperv.h |  1 +
 2 files changed, 32 insertions(+), 21 deletions(-)


base-commit: d135ab453a7400a34930bdda1ef4bdc8acfac80e
-- 
2.34.1