Re: [PATCH v2 0/2] Drivers: hv: vmbus: fix dynamic ID races

[Kameron Carr]

On 10/21/2026 7:33 AM, Jiale Yao wrote:
> VMBus dynamic IDs have two races with their sysfs add and remove paths.
> 
> First, new_id_store() checks for an existing ID separately from inserting
> the new entry, allowing concurrent writers to add duplicate GUIDs. Move the
> check and insertion into one critical section.
> 
> Second, matching returns a pointer into the dynamic ID list after dropping
> the lock. A concurrent remove_id write can free that entry before probe uses
> it. Copy the ID while holding the lock and reject probe when a dynamic ID is
> removed between matching and probing.
> 
> The series was found by static analysis and checked with checkpatch.pl. Each
> patch was also checked individually and in series for application to the
> base commit below.
> 
> Jiale Yao (2):
>   Drivers: hv: vmbus: prevent duplicate dynamic IDs
>   Drivers: hv: vmbus: copy dynamic IDs before dropping the lock
> 
> ---
> Changes in v2:
> - Split the dynamic ID insertion TOCTOU into a preparatory patch.
> - Reject probe when the matching ID disappears before the second lookup.
> - Preserve the ID-less hvsock probe path.
> - Use scoped locking and memcpy() for the dynamic ID copy.
> - Document that the device ID is valid only during probe.
> - Cite the corresponding PCI and USB dynamic ID lifetime fixes.
> - Add Cc: stable@xxxxxxxxxxxxxxx and use the VMBus subject prefix.
> 
> Link: https://lore.kernel.org/r/20261019085544.1834700-1-yaojiale02@xxxxxxx
> 
>  drivers/hv/vmbus_drv.c | 56 +++++++++++++++++++++++++-----------------
>  include/linux/hyperv.h |  1 +
>  2 files changed, 34 insertions(+), 23 deletions(-)
> 
> 
> base-commit: a804c5742bff224d4cb4d25dd383554d598be32b

Performed regression testing in Azure. No issues detected.

Tested-by: Kameron Carr <kameroncarr@xxxxxxxxxxxxxxxxxxx>


Besides the one NIT in PATCH 2/2, for the full series,

Reviewed-by: Kameron Carr <kameroncarr@xxxxxxxxxxxxxxxxxxx>

-- 
Regards,
Kameron