Re: (subset) [PATCH v2 0/2] gpio: sloppy-logic-analyzer: fix debugfs UAF on unbind
Bartosz Golaszewski <[email protected]>
| Newsgroups | org.kernel.vger.linux-gpio,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Fri, 31 Jul 2026 01:02:56 +0300, Cengiz Can wrote:
> Patch 1 fixes a use-after-free. The "trigger" debugfs file uses
> debugfs_create_file_unsafe() with a hand-rolled ->write that dereferences
> the devres-freed gpio_la_poll_priv without holding a debugfs reference, so
> an unbind racing a write frees the object under the handler. Switching to
> debugfs_create_file() makes debugfs_remove_recursive() drain the handler
> first.
>
> [...]
Applied, thanks!
[2/2] gpio: sloppy-logic-analyzer: use debugfs_create_file() for buf_size and capture
https://git.kernel.org/brgl/c/beb0556bccecfea7cfe54d7263dad95950b577ed
Best regards,
--
Bartosz Golaszewski <[email protected]>