| From: |
| Tzung-Bi Shih <tzungbi-AT-kernel.org> |
| To: |
| Arnd Bergmann <arnd-AT-arndb.de>, Greg Kroah-Hartman <gregkh-AT-linuxfoundation.org> |
| Subject: |
| [PATCH 0/8] char: misc: Introduce misc_sync to fix UAF |
| Date: |
| Mon, 27 Apr 2026 21:46:51 +0800 |
| Message-ID: |
| <20260427134659.95181-1-tzungbi@kernel.org> |
| Cc: |
| Benson Leung <bleung-AT-chromium.org>, tzungbi-AT-kernel.org, linux-kernel-AT-vger.kernel.org, chrome-platform-AT-lists.linux.dev, "Rafael J. Wysocki" <rafael-AT-kernel.org>, Danilo Krummrich <dakr-AT-kernel.org>, Jonathan Corbet <corbet-AT-lwn.net>, Shuah Khan <shuah-AT-kernel.org>, Laurent Pinchart <laurent.pinchart-AT-ideasonboard.com>, Wolfram Sang <wsa+renesas-AT-sang-engineering.com>, Jason Gunthorpe <jgg-AT-nvidia.com>, Johan Hovold <johan-AT-kernel.org>, "Paul E . McKenney" <paulmck-AT-kernel.org>, Dan Williams <dan.j.williams-AT-intel.com> |
| Archive-link: |
| Article |
This series introduces misc_sync to address potential Use-After-Free
errors when a device is deregistered while file operations are still in
progress or files remain open. It then adopts the mechanism in
cros_ec_chardev driver.
- Patches 1 and 2 are independent refactors in the misc subsystem.
These are safe cleanups and should be fine to apply.
- Patch 3 is the initial Proof-of-Concept for misc_sync. It uses a
global lock to serialize file operations, so a performance downgrade
is expected.
- Patch 4 is an improvement over the PoC that replaces the global lock
with SRCU for list traversal in the file operations, avoiding
performance bottlenecks.
- Patches 5 to 7 are preparation steps in cros_ec_chardev driver. They
introduce reference counting for platform driver data and an event
relayer. This removes the direct access to `ec_dev->event_notifier`
in `cros_ec_chardev_release()`, which is a prerequisite for using
misc_sync safely in this driver.
- Patch 8 switches cros_ec_chardev driver to use misc_sync.
Tzung-Bi Shih (8):
char: misc: Simplify locking with guard()
char: misc: Introduce misc_find() helper
char: misc: Introduce misc_sync_register()
char: misc: Use SRCU to protect list traversal
platform/chrome: cros_ec_chardev: Introduce chardev_data
platform/chrome: cros_ec_chardev: Move data to chardev_pdata
platform/chrome: cros_ec_chardev: Add event relayer
platform/chrome: cros_ec_chardev: Use misc_sync_register()
drivers/char/misc.c | 228 +++++++++++++++++-----
drivers/platform/chrome/cros_ec_chardev.c | 113 ++++++++---
include/linux/miscdevice.h | 10 +
3 files changed, 272 insertions(+), 79 deletions(-)
--
2.51.0
