Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9561475d authored by Nicolai Stange's avatar Nicolai Stange Committed by Bjorn Helgaas
Browse files

PCI: Fix race condition with driver_override 



The driver_override implementation is susceptible to a race condition when
different threads are reading vs. storing a different driver override.  Add
locking to avoid the race condition.

This is in close analogy to commit 62655397 ("driver core: platform:
fix race condition with driver_override") from Adrian Salido.

Fixes: 782a985d ("PCI: Introduce new device binding path using pci_dev.driver_override")
Signed-off-by: default avatarNicolai Stange <nstange@suse.de>
Signed-off-by: default avatarBjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org	# v3.16+
parent fe594932

drivers/pci/pci-sysfs.c

+9 −2
Original line number Diff line number Diff line
@@ -686,7 +686,7 @@ static ssize_t driver_override_store(struct device *dev, 
				     const char *buf, size_t count)

{

	struct pci_dev *pdev = to_pci_dev(dev);

	char *driver_override, *old = pdev->driver_override, *cp;

	char *driver_override, *old, *cp;



	/* We need to keep extra room for a newline */

	if (count >= (PAGE_SIZE - 1))
@@ -700,12 +700,15 @@ static ssize_t driver_override_store(struct device *dev, 
	if (cp)

		*cp = '\0';



	device_lock(dev);

	old = pdev->driver_override;

	if (strlen(driver_override)) {

		pdev->driver_override = driver_override;

	} else {

		kfree(driver_override);

		pdev->driver_override = NULL;

	}

	device_unlock(dev);



	kfree(old);
@@ -716,8 +719,12 @@ static ssize_t driver_override_show(struct device *dev, 
				    struct device_attribute *attr, char *buf)

{

	struct pci_dev *pdev = to_pci_dev(dev);

	ssize_t len;



	return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);

	device_lock(dev);

	len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);

	device_unlock(dev);

	return len;

}

static DEVICE_ATTR_RW(driver_override);