Re: [PATCH v2 1/2] gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

--hJpq6GjMxq/zMXqA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Jul 31, 2026 at 01:02:57AM +0300, Cengiz Can wrote:
> The "trigger" debugfs file has a hand-rolled ->write handler
> (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
> file is created with debugfs_create_file_unsafe(), and the handler never
> takes a debugfs reference. Nothing keeps the object alive while the
> handler runs.
>=20
> priv is allocated with devm_kzalloc(). devres frees it when the platform
> device is unbound. debugfs_create_file_unsafe() installs no full_proxy
> wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
> wait for an in-flight trigger_write(). The blob_lock taken there does not
> help, because trigger_write() never takes it. A write that races an unbind
> therefore writes into freed memory:
>=20
>   trigger_write()                  gpio_la_poll_remove()
>     priv =3D m->private
>     buf =3D memdup_user()  [may sleep]
>                                      mutex_lock(&priv->blob_lock)
>                                      debugfs_remove_recursive()  [no wait]
>                                      mutex_unlock(&priv->blob_lock)
>                                    (remove returns; devres frees priv)
>     priv->trig_data =3D buf   <-- use-after-free write
>     priv->trig_len  =3D count
>=20
> The race is reachable by root via
> /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.
>=20
> Create "trigger" with debugfs_create_file() instead. Its full_proxy
> wrapper makes debugfs_remove_recursive() drain any in-flight ->write
> before it returns.
>=20
> The use-after-free is confirmed under KASAN with a minimal reproducer of
> the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
> (available on request); it produces a slab-use-after-free write in the
> handler.
>=20
> Fixes: 7828b7bbbf20 ("gpio: add sloppy logic analyzer using polling")
> Cc: [email protected]
> Assisted-by: Claude:claude-opus-4.8
> Signed-off-by: Cengiz Can <[email protected]>

Reviewed-by: Wolfram Sang <[email protected]>


--hJpq6GjMxq/zMXqA
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmpuWGYACgkQFA3kzBSg
KbbUDxAAsWK37NbgW+VKEOJp2xFuzvnQs5z/IoLfLtfwoLBjmRGbJ1rcsj00nzKX
0utqOJBer6tA+9Ucj2KDOk1FqziLRgXjMDxBBJn9vQoQD1klAPvuXqodW+IoA8Vb
qYAc0MtEAo38stYrLknEOHg98UQgtfOMDmGaAL2z8FFfr2MZb745ksYoL39gnp4J
qSb1OJkxxlAImgr3Wf8nZmzFEGtb4dimIwpOZU43uuC9Qefb0zLV8Yf3mdgzcuDA
BWyKeAwVkLw1bfM+m1n8B1VI3gE/KahSlwFLw9+3dp/8EQTlwz4XTzYnaeUdMKvX
Kn8tt3y4VzFdH3erEIqSru+xZqeMHwePqmsvlavTiAt4cMSA6sYcZJ0CA3BSHw+J
HEnL9BtMYK3Ln/J2Hs6TFe8OCjWzKMVoaLGXPK87AVn14CGa0vPbZbd//B3lZ1QA
iAaNqp9/JCenwE6oFqxxopWu/xHRkVtCVvcqK9PhjX36aPNtx+jTD97fDmcLXCHT
v3YPlJfIeKXxh0TMO0E6i/3t5LoTIn2MqDS7uBsq8/4LgR5j2gtKmOb/5uqQgr4K
n5BTlNzq7M0FFQ4aiya1qaKw2Pr2BSBYH5YVyDAdngbqfe3oHt/u+5VJv9GnUSFi
qJKRb6sJ/jRyOfiTDQAIEixzSZwKMuqZubnCTzbYLuCvojME2DI=
=RyH1
-----END PGP SIGNATURE-----

--hJpq6GjMxq/zMXqA--