diff options
| author | Gary Guo <gary@garyguo.net> | 2026-07-23 23:00:48 +0100 |
|---|---|---|
| committer | Bjorn Helgaas <bhelgaas@google.com> | 2026-07-28 11:20:29 -0500 |
| commit | 3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc (patch) | |
| tree | a93f1782a83d2a7a1bd5fc586da175992bc15295 /include/linux | |
| parent | 04fde70f782b6ce984f9f80c2023786caea28287 (diff) | |
PCI: Fix UAF when probe runs concurrent to dyn ID removal
Dynamic IDs are only guaranteed to be valid when dynids.lock is held,
as remove_id_store() can free the node. Thus, make a copy in
pci_match_device(). Also, clarify that the id parameter is only valid
during probe.
Fixes: 0994375e9614 ("PCI: add remove_id sysfs entry")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260619170503.518F61F00A3A@smtp.kernel.org/
Signed-off-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260723-pci_id_fix-v4-9-3580726844e1@garyguo.net
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/pci.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/pci.h b/include/linux/pci.h index ebb5b9d76360..f128d8c0cbb6 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -979,6 +979,7 @@ struct module; * function returns zero when the driver chooses to * take "ownership" of the device or an error code * (negative number) otherwise. + * The pci_device_id parameter is only valid during probe. * The probe function always gets called from process * context, so it can sleep. * @remove: The remove() function gets called whenever a device |