[PATCH] drivers: firmware_loader: fix race between sysfs fallback cleanup and device removal

[l1za0 . sec]

From: Haocheng Yu <l1za0.sec@xxxxxxxxx>

A WARNING in firmware_fallback_sysfs is reported by a modified
Syzkaller-based kernel fuzzing tool that we developed.

The cause of this issue is a possible race condition between
firmware sysfs fallback cleanup and hot-plug or other device
lifecycle paths.

In this case, fw_load_sysfs_fallback() might run cleanup after the
fallback device has already been removed, i.e., it would execute
device_del(), then dpm_sysfs_remove(), and finally trigger a
warning in sysfs_remove_group().

This problem can be avoided by adding device_is_registered()
check before calling device_del().

Signed-off-by: Haocheng Yu <l1za0.sec@xxxxxxxxx>
---
 drivers/base/firmware_loader/fallback.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/base/firmware_loader/fallback.c b/drivers/base/firmware_loader/fallback.c
index bf68e3947814..a8d8c494f82d 100644
--- a/drivers/base/firmware_loader/fallback.c
+++ b/drivers/base/firmware_loader/fallback.c
@@ -116,8 +116,9 @@ static int fw_load_sysfs_fallback(struct fw_sysfs *fw_sysfs, long timeout)
 	} else if (fw_priv->is_paged_buf && !fw_priv->data)
 		retval = -ENOMEM;
 
-out:
-	device_del(f_dev);
+out:
+	if (device_is_registered(f_dev))
+		device_del(f_dev);
 err_put_dev:
 	put_device(f_dev);
 	return retval;

base-commit: ffc253263a1375a65fa6c9f62a893e9767fbebfa
-- 
2.51.0