[PATCH v2 2/2] rust: serdev: Fix race condition on driver probe
flat view
COLD38d
From: Markus Probst <markus.probst@posteo.de>
Date: 2026-09-05 13:30:22
Also in:
driver-core, lkml, rust-for-linux
Subsystem:
driver core, kobjects, debugfs and sysfs, rust, serial device bus, the rest · Maintainers:
Greg Kroah-Hartman, "Rafael J. Wysocki", Danilo Krummrich, Miguel Ojeda, Markus Probst, Linus Torvalds
If `Driver::probe` fails, the pointer to the driver data (`PrivateData`)
will first be set to NULL by `drvdata_obtain` and only after that the
serdev device will be closed by Drop. Thus there is a small window in
which the serdev device is still open, but the pointer to the driver data
is NULL. Therefore it is possible that `receive_buf_callback` might try to
access the `active` mutex on a null pointer.
Use previously added `drvdata_drop` instead of `drvdata_obtain`, so the
serdev device will first be closed with Drop and after that the pointer to
the driver data will be set to NULL.
Remove `drvdata_obtain`, as it is now dead code.
Fixes: 99f59aa82341 ("rust: add basic serial device bus abstractions")
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-serial/20260903222159.70A911F000E9@smtp.kernel.org/ (local)
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
rust/kernel/device.rs | 25 -------------------------
rust/kernel/serdev.rs | 2 +-
2 files changed, 1 insertion(+), 26 deletions(-)
diff --git a/rust/kernel/device.rs b/rust/kernel/device.rs
index 3886cc713c28..834fea0eb0a7 100644
--- a/rust/kernel/device.rs
+++ b/rust/kernel/device.rs@@ -213,31 +213,6 @@ pub fn set_drvdata<T>(&self, data: impl PinInit<T, Error>) -> Result { Ok(()) } - /// Take ownership of the private data stored in this [`Device`]. - /// - /// # Safety - /// - /// - The type `T` must match the type of the `ForeignOwnable` previously stored by - /// [`Device::set_drvdata`]. - /// - Must only be called before the device is fully unbound. - pub(crate) unsafe fn drvdata_obtain<T>(&self) -> Option<Pin<KBox<T>>> { - // SAFETY: By the type invariants, `self.as_raw()` is a valid pointer to a `struct device`. - let ptr = unsafe { bindings::dev_get_drvdata(self.as_raw()) }; - - // SAFETY: By the type invariants, `self.as_raw()` is a valid pointer to a `struct device`. - unsafe { bindings::dev_set_drvdata(self.as_raw(), core::ptr::null_mut()) }; - - if ptr.is_null() { - return None; - } - - // SAFETY: - // - If `ptr` is not NULL, it comes from a previous call to `into_foreign()`. - // - `dev_get_drvdata()` guarantees to return the same pointer given to `dev_set_drvdata()` - // in `into_foreign()`. - Some(unsafe { Pin::<KBox<T>>::from_foreign(ptr.cast()) }) - } - /// Drop the private data stored in this [`Device`]. /// /// The pointer to the private data remains valid until the drop is complete.
diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs
index 17ca504b7f8d..a12b1dea12aa 100644
--- a/rust/kernel/serdev.rs
+++ b/rust/kernel/serdev.rs@@ -176,7 +176,7 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi: let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() }; let private_data = ScopeGuard::new_with_data(private_data, |_| { // SAFETY: We just set drvdata to `PrivateData<'_, T>`. - drop(unsafe { sdev.as_ref().drvdata_obtain::<PrivateData<'_, T>>() }); + unsafe { sdev.as_ref().drvdata_drop::<PrivateData<'_, T>>() }; }); let mut active = private_data.active.lock();
--
2.55.0