github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

misc: tifm: don't clear dev->driver in tifm_device_remove()

Browse Source 
tifm_device_remove() sets sock->dev.driver to NULL after calling the
driver's remove() callback. Since commit a995fe1a3a ("rust: driver:
drop device private data post unbind"), device_unbind_cleanup()
dereferences dev->driver after the bus remove() callback has returned,
so removing a card from a TI FlashMedia reader oopses:

  BUG: kernel NULL pointer dereference, address: 0000000000000090
  Workqueue: tifm tifm_7xx1_switch_media [tifm_7xx1]
  RIP: 0010:device_unbind_cleanup+0x16/0xb0
  Call Trace:
   device_release_driver_internal+0x220/0x260
   device_release_driver+0x12/0x20
   bus_remove_device+0xf9/0x1c0
   device_del+0x161/0x3b0
   device_unregister+0x17/0x70
   tifm_7xx1_switch_media.cold+0x6b/0xbd [tifm_7xx1]
   process_one_work+0x1ac/0x3d0
   worker_thread+0x1b8/0x360
   kthread+0xf7/0x130
   ret_from_fork+0x195/0x2a0
   ret_from_fork_asm+0x1a/0x30

The driver core clears dev->driver itself in device_unbind_cleanup(), so
there is no need for the bus code to do it. Remove the assignment.

The problem was found and the fix written with the help of an AI coding
assistant. Tested on a Dell Precision M6500 (TI PCIxx12 FlashMedia,
104c:803b) running a 7.0 kernel: removing an SD card oopsed every time
without the fix; with it, insert, read and remove work.

Fixes: a995fe1a3a ("rust: driver: drop device private data post unbind")
Cc: stable@kernel.org
Assisted-by: LLM
Signed-off-by: Joshua Mulloy <joshuamulloy@gmail.com>
Link: https://patch.msgid.link/20261004102525.34356-1-joshuamulloy@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Joshua Mulloy 2026-10-04 06:25:25 -04:00 committed by Greg Kroah-Hartman
parent a8af929e9d
commit 2b23952d70
1 changed files with 0 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/misc/tifm_core.c
View File

@ -97,7 +97,6 @@ static void tifm_device_remove(struct device *dev)
sock->card_event = tifm_dummy_event;
sock->data_event = tifm_dummy_event;
drv->remove(sock);
sock->dev.driver = NULL;
}
put_device(dev);