diff options
| author | Danilo Krummrich <dakr@kernel.org> | 2026-04-18 18:22:18 +0200 |
|---|---|---|
| committer | Danilo Krummrich <dakr@kernel.org> | 2026-04-29 00:35:38 +0200 |
| commit | e9506871a8ea304cde48ff4a57226df2aadddae3 (patch) | |
| tree | 8e7a76755611a5acadc413647d8dbd1e0a3a75d8 /include/linux/device.h | |
| parent | c9447f101315bcec9b6603de0be59ca0e6b8b505 (diff) | |
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
dev_has_sync_state() reads dev->driver twice without holding
device_lock() -- once for the NULL check and once to dereference
->sync_state. Some callers only hold device_links_write_lock, which
doesn't prevent a concurrent unbind from clearing dev->driver via
device_unbind_cleanup().
Fix it by reading dev->driver exactly once with READ_ONCE(), pairing
with the WRITE_ONCE() in device_set_driver().
Link: https://lore.kernel.org/driver-core/DHW8QPU1VU1F.3P6PH69HLFBYC@kernel.org/
Fixes: ac338acf514e ("driver core: Add dev_has_sync_state()")
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Saravana Kannan <saravanak@kernel.org>
Link: https://patch.msgid.link/20260418162221.1121873-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Diffstat (limited to 'include/linux/device.h')
| -rw-r--r-- | include/linux/device.h | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/include/linux/device.h b/include/linux/device.h index 3bf86d2f9544..56a96e41d2c9 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1063,9 +1063,12 @@ static inline void device_lock_assert(struct device *dev) static inline bool dev_has_sync_state(struct device *dev) { + struct device_driver *drv; + if (!dev) return false; - if (dev->driver && dev->driver->sync_state) + drv = READ_ONCE(dev->driver); + if (drv && drv->sync_state) return true; if (dev->bus && dev->bus->sync_state) return true; |