On Mon, 13 Aug 2018 19:30:50 +0000 "Michael Kelley (EOSG)" <Michael.H.Kelley@xxxxxxxxxxxxx> wrote: > > +/* > > + * Return a matching hv_vmbus_device_id pointer. > > + * If there is no match, return NULL. > > + */ > > +static const struct hv_vmbus_device_id *hv_vmbus_get_id(struct hv_driver *drv, > > + struct hv_device *dev) > > +{ > > + const uuid_le *guid = &dev->dev_type; > > + const struct hv_vmbus_device_id *id; > > > > - return NULL; > > + /* When driver_override is set, only bind to the matching driver */ > > + if (dev->driver_override && strcmp(dev->driver_override, drv->name)) > > + return NULL; > > This function needs to be covered by the device lock, so that > dev->driver_override can't be set to NULL and the memory freed > during the above 'if' statement. When called from vmbus_probe(), > the device lock is held, so it's good. But when called from > vmbus_match(), the device lock may not be held: consider the path > __driver_attach() -> driver_match_device() -> vmbus_match(). The function hv_vmbus_get_id is called from that path. i.e. __device_attach -> driver-match_device -> vmbus_match. and __device_attach always does: device_lock(dev); The code in driver _override_store uses the same device_lock when storing the new value. This is same locking as is done in pci-sysfs.c _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel