From: Zhenzhong Duan <zhenzhong.duan@gmail.com> mainline inclusion from mainline-v5.11-rc1 commit 3853f9123c185eb4018f5ccd3cdda5968efb5e10 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15817 CVE: CVE-2026-53120 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- When a device ID is written to /sys/bus/pci/drivers/.../new_id, we previously only checked the driver's static ID table for duplicates. Writing the same ID several times added it to the dynamic IDs list several times. This doesn't cause user-visible broken behavior, but remove_id_store() only removes one of the duplicate IDs, so if we add an ID several times, we would have to remove it the same number of times before it's completely gone. Fix it by calling pci_match_device(), which checks both dynamic and static IDs to avoid inserting duplicate IDs in dynamic IDs list. After fix, attempts to add an ID more than once cause an error: # echo "1af4 1041" > /sys/bus/pci/drivers/vfio-pci/new_id # echo "1af4 1041" > /sys/bus/pci/drivers/vfio-pci/new_id bash: echo: write error: File exists Link: https://lore.kernel.org/r/20201117054409.3428-3-zhenzhong.duan@gmail.com Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Ziming Du <duziming2@huawei.com> --- drivers/pci/pci-driver.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c index 65e9543403589..337ea5883e7a5 100644 --- a/drivers/pci/pci-driver.c +++ b/drivers/pci/pci-driver.c @@ -200,7 +200,7 @@ static ssize_t new_id_store(struct device_driver *driver, const char *buf, pdev->subsystem_device = subdevice; pdev->class = class; - if (pci_match_id(pdrv->id_table, pdev)) + if (pci_match_device(pdrv, pdev)) retval = -EEXIST; kfree(pdev); -- 2.43.0