[PATCH openEuler-1.0-LTS 0/3] *** revert CVE-2026-31527 ***
*** revert CVE-2026-31527 *** Lin Ruifeng (3): Revert "driver/core: Fix kabi broken of platform_device/device/bus_type" Revert "driver core: platform: use generic driver_override infrastructure" Revert "driver core: generalize driver_override in struct device" drivers/base/bus.c | 49 +-------------------- drivers/base/core.c | 3 -- drivers/base/dd.c | 61 --------------------------- drivers/base/platform.c | 57 ++++++++++++++++++++++--- drivers/slimbus/qcom-ngd-ctrl.c | 12 +----- include/linux/device.h | 75 --------------------------------- include/linux/platform_device.h | 7 +-- 7 files changed, 55 insertions(+), 209 deletions(-) -- 2.43.0
hulk inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------- This reverts commit 308a322bb1dbeb7b9e0ad3430cfee4d818303d67. Fixes: 308a322bb1db ("driver/core: Fix kabi broken of platform_device/device/bus_type") Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com> --- include/linux/device.h | 15 +++++---------- include/linux/platform_device.h | 6 ------ 2 files changed, 5 insertions(+), 16 deletions(-) diff --git a/include/linux/device.h b/include/linux/device.h index 5bc8548486fe..f6aef1f7171e 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -147,10 +147,8 @@ struct bus_type { struct subsys_private *p; struct lock_class_key lock_key; - bool need_parent_lock; -#ifndef __GENKSYMS__ bool driver_override; -#endif + bool need_parent_lock; }; extern int __must_check bus_register(struct bus_type *bus); @@ -1007,6 +1005,10 @@ struct device { core doesn't touch it */ void *driver_data; /* Driver data, set and get with dev_set/get_drvdata */ + struct { + const char *name; + spinlock_t lock; + } driver_override; struct dev_links_info links; struct dev_pm_info power; struct dev_pm_domain *pm_domain; @@ -1099,15 +1101,8 @@ struct device { #else KABI_RESERVE(2) #endif -#ifndef __GENKSYMS__ - struct { - const char *name; - spinlock_t lock; - } driver_override; -#else KABI_RESERVE(3) KABI_RESERVE(4) -#endif KABI_RESERVE(5) KABI_RESERVE(6) KABI_RESERVE(7) diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index 5a2db0dc1ac1..eef1e77eb43b 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -30,12 +30,6 @@ struct platform_device { const struct platform_device_id *id_entry; -#ifndef __GENKSYMS__ - char *kabi_reserved_driver_override; -#else - char *driver_override; -#endif - /* MFD cell pointer */ struct mfd_cell *mfd_cell; -- 2.43.0
hulk inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------- This reverts commit 9b2f4d280b165327f2266447a58491137d0aa1fc. Fixes: 9b2f4d280b16 ("driver core: platform: use generic driver_override infrastructure") Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com> --- drivers/base/platform.c | 57 ++++++++++++++++++++++++++++++--- drivers/slimbus/qcom-ngd-ctrl.c | 12 +------ include/linux/platform_device.h | 1 + 3 files changed, 54 insertions(+), 16 deletions(-) diff --git a/drivers/base/platform.c b/drivers/base/platform.c index 4a2e15e74a06..e332579744fb 100644 --- a/drivers/base/platform.c +++ b/drivers/base/platform.c @@ -268,6 +268,7 @@ static void platform_device_release(struct device *dev) kfree(pa->pdev.dev.platform_data); kfree(pa->pdev.mfd_cell); kfree(pa->pdev.resource); + kfree(pa->pdev.driver_override); kfree(pa); } @@ -881,8 +882,57 @@ static ssize_t modalias_show(struct device *dev, } static DEVICE_ATTR_RO(modalias); +static ssize_t driver_override_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) +{ + struct platform_device *pdev = to_platform_device(dev); + char *driver_override, *old, *cp; + + /* We need to keep extra room for a newline */ + if (count >= (PAGE_SIZE - 1)) + return -EINVAL; + + driver_override = kstrndup(buf, count, GFP_KERNEL); + if (!driver_override) + return -ENOMEM; + + cp = strchr(driver_override, '\n'); + if (cp) + *cp = '\0'; + + device_lock(dev); + old = pdev->driver_override; + if (strlen(driver_override)) { + pdev->driver_override = driver_override; + } else { + kfree(driver_override); + pdev->driver_override = NULL; + } + device_unlock(dev); + + kfree(old); + + return count; +} + +static ssize_t driver_override_show(struct device *dev, + struct device_attribute *attr, char *buf) +{ + struct platform_device *pdev = to_platform_device(dev); + ssize_t len; + + device_lock(dev); + len = sysfs_emit(buf, "%s\n", pdev->driver_override); + device_unlock(dev); + return len; +} +static DEVICE_ATTR_RW(driver_override); + + static struct attribute *platform_dev_attrs[] = { &dev_attr_modalias.attr, + &dev_attr_driver_override.attr, NULL, }; ATTRIBUTE_GROUPS(platform_dev); @@ -937,12 +987,10 @@ static int platform_match(struct device *dev, struct device_driver *drv) { struct platform_device *pdev = to_platform_device(dev); struct platform_driver *pdrv = to_platform_driver(drv); - int ret; /* When driver_override is set, only bind to the matching driver */ - ret = device_match_driver_override(dev, drv); - if (ret >= 0) - return ret; + if (pdev->driver_override) + return !strcmp(pdev->driver_override, drv->name); /* Attempt an OF style match first */ if (of_driver_match_device(dev, drv)) @@ -1129,7 +1177,6 @@ static const struct dev_pm_ops platform_dev_pm_ops = { struct bus_type platform_bus_type = { .name = "platform", .dev_groups = platform_dev_groups, - .driver_override = true, .match = platform_match, .uevent = platform_uevent, .dma_configure = platform_dma_configure, diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c index 6d2c0d2f5696..9221ba7b7863 100644 --- a/drivers/slimbus/qcom-ngd-ctrl.c +++ b/drivers/slimbus/qcom-ngd-ctrl.c @@ -1329,7 +1329,6 @@ static int of_qcom_slim_ngd_register(struct device *parent, const struct of_device_id *match; struct device_node *node; u32 id; - int ret; match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node); data = match->data; @@ -1346,18 +1345,9 @@ static int of_qcom_slim_ngd_register(struct device *parent, kfree(ngd); return -ENOMEM; } - - ret = device_set_driver_override(&ngd->pdev->dev, - QCOM_SLIM_NGD_DRV_NAME); - if (ret) { - platform_device_put(ngd->pdev); - kfree(ngd); - of_node_put(node); - return ret; - } - ngd->id = id; ngd->pdev->dev.parent = parent; + ngd->pdev->driver_override = QCOM_SLIM_NGD_DRV_NAME; ngd->pdev->dev.of_node = node; ctrl->ngd = ngd; platform_set_drvdata(ngd->pdev, ctrl); diff --git a/include/linux/platform_device.h b/include/linux/platform_device.h index eef1e77eb43b..9e5c98fcea8c 100644 --- a/include/linux/platform_device.h +++ b/include/linux/platform_device.h @@ -29,6 +29,7 @@ struct platform_device { struct resource *resource; const struct platform_device_id *id_entry; + char *driver_override; /* Driver name to force a match */ /* MFD cell pointer */ struct mfd_cell *mfd_cell; -- 2.43.0
hulk inclusion category: bugfix bugzilla: NA CVE: NA -------------------------------- This reverts commit d9b8147764580ff2d0d158ea02445c521ce9c7f2. Fixes: d9b814776458 ("driver core: generalize driver_override in struct device") Signed-off-by: Lin Ruifeng <linruifeng4@huawei.com> --- drivers/base/bus.c | 49 +---------------------------- drivers/base/core.c | 3 -- drivers/base/dd.c | 61 ------------------------------------ include/linux/device.h | 70 ------------------------------------------ 4 files changed, 1 insertion(+), 182 deletions(-) diff --git a/drivers/base/bus.c b/drivers/base/bus.c index 44abd34a3243..f45506c56c33 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -457,41 +457,6 @@ int bus_for_each_drv(struct bus_type *bus, struct device_driver *start, } EXPORT_SYMBOL_GPL(bus_for_each_drv); -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - int ret; - - ret = __device_set_driver_override(dev, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - int ret; - - spin_lock(&dev->driver_override.lock); - ret = sysfs_emit(buf, "%s\n", dev->driver_override.name); - spin_unlock(&dev->driver_override.lock); - - return ret; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *driver_override_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group driver_override_dev_group = { - .attrs = driver_override_dev_attrs, -}; - /** * bus_add_device - add device to bus * @dev: device being added @@ -510,17 +475,10 @@ int bus_add_device(struct device *dev) error = device_add_groups(dev, bus->dev_groups); if (error) goto out_put; - - if (dev->bus->driver_override) { - error = device_add_group(dev, &driver_override_dev_group); - if (error) - goto out_groups; - } - error = sysfs_create_link(&bus->p->devices_kset->kobj, &dev->kobj, dev_name(dev)); if (error) - goto out_override; + goto out_groups; error = sysfs_create_link(&dev->kobj, &dev->bus->p->subsys.kobj, "subsystem"); if (error) @@ -531,9 +489,6 @@ int bus_add_device(struct device *dev) out_subsys: sysfs_remove_link(&bus->p->devices_kset->kobj, dev_name(dev)); -out_override: - if (dev->bus->driver_override) - device_remove_group(dev, &driver_override_dev_group); out_groups: device_remove_groups(dev, bus->dev_groups); out_put: @@ -592,8 +547,6 @@ void bus_remove_device(struct device *dev) sysfs_remove_link(&dev->kobj, "subsystem"); sysfs_remove_link(&dev->bus->p->devices_kset->kobj, dev_name(dev)); - if (dev->bus->driver_override) - device_remove_group(dev, &driver_override_dev_group); device_remove_groups(dev, dev->bus->dev_groups); if (klist_node_attached(&dev->p->knode_bus)) klist_del(&dev->p->knode_bus); diff --git a/drivers/base/core.c b/drivers/base/core.c index 99a76b1ff5e5..a06e0cc4183e 100644 --- a/drivers/base/core.c +++ b/drivers/base/core.c @@ -1069,8 +1069,6 @@ static void device_release(struct kobject *kobj) */ devres_release_all(dev); - kfree(dev->driver_override.name); - if (dev->release) dev->release(dev); else if (dev->type && dev->type->release) @@ -1684,7 +1682,6 @@ void device_initialize(struct device *dev) kobject_init(&dev->kobj, &device_ktype); INIT_LIST_HEAD(&dev->dma_pools); mutex_init(&dev->mutex); - spin_lock_init(&dev->driver_override.lock); lockdep_set_novalidate_class(&dev->mutex); spin_lock_init(&dev->devres_lock); INIT_LIST_HEAD(&dev->devres_head); diff --git a/drivers/base/dd.c b/drivers/base/dd.c index a323b4356ebe..432a5645bac3 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -27,7 +27,6 @@ #include <linux/async.h> #include <linux/pm_runtime.h> #include <linux/pinctrl/devinfo.h> -#include <linux/slab.h> #include "base.h" #include "power/power.h" @@ -307,66 +306,6 @@ static void __exit deferred_probe_exit(void) } __exitcall(deferred_probe_exit); -int __device_set_driver_override(struct device *dev, const char *s, size_t len) -{ - const char *new, *old; - char *cp; - - if (!s) - return -EINVAL; - - /* - * The stored value will be used in sysfs show callback (sysfs_emit()), - * which has a length limit of PAGE_SIZE and adds a trailing newline. - * Thus we can store one character less to avoid truncation during sysfs - * show. - */ - if (len >= (PAGE_SIZE - 1)) - return -EINVAL; - - /* - * Compute the real length of the string in case userspace sends us a - * bunch of \0 characters like python likes to do. - */ - len = strlen(s); - - if (!len) { - /* Empty string passed - clear override */ - spin_lock(&dev->driver_override.lock); - old = dev->driver_override.name; - dev->driver_override.name = NULL; - spin_unlock(&dev->driver_override.lock); - kfree(old); - - return 0; - } - - cp = strnchr(s, len, '\n'); - if (cp) - len = cp - s; - - new = kstrndup(s, len, GFP_KERNEL); - if (!new) - return -ENOMEM; - - spin_lock(&dev->driver_override.lock); - old = dev->driver_override.name; - if (cp != s) { - dev->driver_override.name = new; - spin_unlock(&dev->driver_override.lock); - } else { - /* "\n" passed - clear override */ - dev->driver_override.name = NULL; - spin_unlock(&dev->driver_override.lock); - - kfree(new); - } - kfree(old); - - return 0; -} -EXPORT_SYMBOL_GPL(__device_set_driver_override); - /** * device_is_bound() - Check if device is bound to a driver * @dev: device to check diff --git a/include/linux/device.h b/include/linux/device.h index f6aef1f7171e..2bcd6f4974b9 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -101,9 +101,6 @@ extern void bus_remove_file(struct bus_type *, struct bus_attribute *); * @p: The private data of the driver core, only the driver core can * touch this. * @lock_key: Lock class key for use by the lock validator - * @driver_override: Set to true if this bus supports the driver_override - * mechanism, which allows userspace to force a specific - * driver to bind to a device via a sysfs attribute. * @need_parent_lock: When probing or removing a device on this bus, the * device core should lock the device's parent. * @@ -147,7 +144,6 @@ struct bus_type { struct subsys_private *p; struct lock_class_key lock_key; - bool driver_override; bool need_parent_lock; }; @@ -929,8 +925,6 @@ struct dev_links_info { * on. This shrinks the "Board Support Packages" (BSPs) and * minimizes board-specific #ifdefs in drivers. * @driver_data: Private pointer for driver specific info. - * @driver_override: Driver name to force a match. Do not touch directly; use - * device_set_driver_override() instead. * @links: Links to suppliers and consumers of this device. * @power: For device power management. * See Documentation/driver-api/pm/devices.rst for details. @@ -1005,10 +999,6 @@ struct device { core doesn't touch it */ void *driver_data; /* Driver data, set and get with dev_set/get_drvdata */ - struct { - const char *name; - spinlock_t lock; - } driver_override; struct dev_links_info links; struct dev_pm_info power; struct dev_pm_domain *pm_domain; @@ -1127,66 +1117,6 @@ static inline struct device *kobj_to_dev(struct kobject *kobj) return container_of(kobj, struct device, kobj); } -int __device_set_driver_override(struct device *dev, const char *s, size_t len); - -/** -+ * device_set_driver_override() - Helper to set or clear driver override. -+ * @dev: Device to change -+ * @s: NUL-terminated string, new driver name to force a match, pass empty -+ * string to clear it ("" or "\n", where the latter is only for sysfs -+ * interface). -+ * -+ * Helper to set or clear driver override of a device. -+ * -+ * Returns: 0 on success or a negative error code on failure. -+ */ -static inline int device_set_driver_override(struct device *dev, const char *s) -{ - return __device_set_driver_override(dev, s, s ? strlen(s) : 0); -} - -/** -+ * device_has_driver_override() - Check if a driver override has been set. -+ * @dev: device to check -+ * -+ * Returns true if a driver override has been set for this device. -+ */ -static inline bool device_has_driver_override(struct device *dev) -{ - int ret; - - spin_lock(&dev->driver_override.lock); - ret = !!dev->driver_override.name; - spin_unlock(&dev->driver_override.lock); - - return ret; -} - -/** -+ * device_match_driver_override() - Match a driver against the device's driver_override. -+ * @dev: device to check -+ * @drv: driver to match against -+ * -+ * Returns > 0 if a driver override is set and matches the given driver, 0 if a -+ * driver override is set but does not match, or < 0 if a driver override is not -+ * set at all. -+ */ -static inline int device_match_driver_override(struct device *dev, - const struct device_driver *drv) -{ - int ret; - - spin_lock(&dev->driver_override.lock); - if (dev->driver_override.name) { - ret = !strcmp(dev->driver_override.name, drv->name); - spin_unlock(&dev->driver_override.lock); - return ret; - } - spin_unlock(&dev->driver_override.lock); - - return -1; -} - /* Get the wakeup routines, which depend on struct device */ #include <linux/pm_wakeup.h> -- 2.43.0
反馈: 您发送到kernel@openeuler.org的补丁/补丁集，转换为PR失败！ 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/5HS... 失败原因：调用atomgit api创建PR失败， 失败原因如下： Another open merge request already exists for this source branch: !23620 建议解决方法：请稍等，机器人会在下一次任务重新执行 FeedBack: The patch(es) which you have sent to kernel@openeuler.org has been converted to PR failed! Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/5HS... Failed Reason: create PR failed when call atomgit's api, failed reason is as follows: Another open merge request already exists for this source branch: !23620 Suggest Solution: please wait, the bot will retry in the next interval
反馈： 您发送到kernel@openeuler.org的补丁/补丁集，已成功转换为PR！ PR链接地址： https://atomgit.com/openeuler/kernel/merge_requests/23631 邮件列表地址：https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/5HS... FeedBack: The patch(es) which you have sent to kernel@openeuler.org mailing list has been converted to a pull request successfully! Pull request link: https://atomgit.com/openeuler/kernel/merge_requests/23631 Mailing list address: https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/5HS...
participants (2)
-
Lin Ruifeng -
patchwork bot