Cengiz Can
44f3468a0a
gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
...
The "trigger" debugfs file has a hand-rolled ->write handler
(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
file is created with debugfs_create_file_unsafe(), and the handler never
takes a debugfs reference. Nothing keeps the object alive while the
handler runs.
priv is allocated with devm_kzalloc(). devres frees it when the platform
device is unbound. debugfs_create_file_unsafe() installs no full_proxy
wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
wait for an in-flight trigger_write(). The blob_lock taken there does not
help, because trigger_write() never takes it. A write that races an unbind
therefore writes into freed memory:
trigger_write() gpio_la_poll_remove()
priv = m->private
buf = memdup_user() [may sleep]
mutex_lock(&priv->blob_lock)
debugfs_remove_recursive() [no wait]
mutex_unlock(&priv->blob_lock)
(remove returns; devres frees priv)
priv->trig_data = buf <-- use-after-free write
priv->trig_len = count
The race is reachable by root via
/sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.
Create "trigger" with debugfs_create_file() instead. Its full_proxy
wrapper makes debugfs_remove_recursive() drain any in-flight ->write
before it returns.
The use-after-free is confirmed under KASAN with a minimal reproducer of
the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
(available on request); it produces a slab-use-after-free write in the
handler.
Fixes: 7828b7bbbf ("gpio: add sloppy logic analyzer using polling")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can@canonical.com >
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com >
Link: https://patch.msgid.link/20260730220258.358169-2-cengiz.can@canonical.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com >
2026-08-10 12:49:04 +02:00
..
2026-05-06 10:08:11 +02:00
2026-07-03 07:38:17 +02:00
2024-12-02 11:34:44 -08:00
2023-04-11 21:08:31 +02:00
2025-10-21 11:46:50 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2026-05-07 10:07:05 +02:00
2026-02-18 10:56:35 +01:00
2025-09-24 13:52:35 +02:00
2025-08-07 10:07:06 +02:00
2026-01-27 11:17:26 +01:00
2026-04-20 11:10:39 +02:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2026-05-28 10:46:46 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2025-09-12 09:19:56 +02:00
2026-02-23 10:38:33 +01:00
2025-10-23 09:56:05 +02:00
2026-07-27 13:14:30 +02:00
2026-01-12 11:41:02 +01:00
2026-02-23 10:41:42 +01:00
2025-07-07 09:43:53 +02:00
2025-12-22 17:57:35 +01:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-03-16 10:11:02 +01:00
2025-08-07 10:07:06 +02:00
2026-02-23 10:41:42 +01:00
2026-06-23 10:44:29 +02:00
2025-08-07 10:07:06 +02:00
2026-05-20 15:24:49 +02:00
2026-07-07 14:32:01 +02:00
2026-06-18 10:02:13 +02:00
2025-11-19 14:08:51 +01:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-04-27 09:42:16 +02:00
2025-08-07 10:07:06 +02:00
2026-06-30 09:48:39 +02:00
2025-09-12 09:19:56 +02:00
2026-05-20 15:24:49 +02:00
2026-07-03 07:38:17 +02:00
2024-12-02 11:34:44 -08:00
2026-07-03 07:38:17 +02:00
2025-10-13 17:33:50 +02:00
2026-05-20 15:24:49 +02:00
2026-07-03 07:38:17 +02:00
2025-09-24 13:52:35 +02:00
2026-06-26 11:58:20 +02:00
2024-12-02 11:34:44 -08:00
2023-01-30 15:55:28 +01:00
2025-08-07 10:07:06 +02:00
2025-10-22 08:52:32 +02:00
2023-08-11 14:23:32 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2025-12-18 11:29:42 +01:00
2026-04-28 10:13:40 +02:00
2025-08-07 10:07:06 +02:00
2026-03-16 10:05:33 +01:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2025-10-23 14:30:11 +02:00
2025-08-07 10:07:06 +02:00
2025-09-12 09:22:44 +02:00
2026-02-05 18:00:45 +01:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-01-20 19:44:19 -08:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2026-05-18 09:47:18 +02:00
2025-05-13 15:15:34 +02:00
2026-05-20 15:24:49 +02:00
2022-02-09 13:00:45 +00:00
2026-07-03 07:38:17 +02:00
2026-05-28 10:47:05 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-01-12 11:39:44 +01:00
2024-12-02 11:34:44 -08:00
2026-08-10 12:38:52 +02:00
2026-07-03 07:38:17 +02:00
2026-06-16 09:42:17 +02:00
2025-09-12 09:19:56 +02:00
2025-10-30 10:28:24 +01:00
2026-07-03 07:38:17 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2025-09-06 16:08:10 +05:30
2026-07-03 07:38:17 +02:00
2026-03-09 10:15:00 +01:00
2025-11-25 14:10:06 +01:00
2026-06-30 16:36:35 +02:00
2026-07-08 14:05:11 +02:00
2026-06-16 07:30:52 +05:30
2025-09-12 09:19:56 +02:00
2025-09-16 14:41:57 +01:00
2026-07-03 07:38:17 +02:00
2026-04-07 12:32:21 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2026-01-28 09:29:57 +01:00
2026-07-06 12:01:07 +02:00
2026-07-27 14:58:26 +02:00
2026-05-18 09:47:18 +02:00
2026-07-03 07:38:17 +02:00
2026-07-27 15:07:51 +02:00
2025-10-21 11:46:50 +02:00
2024-11-04 09:15:38 +01:00
2026-06-16 09:19:32 +02:00
2025-11-25 14:10:06 +01:00
2025-06-23 09:25:46 +02:00
2026-05-28 10:46:46 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2025-09-24 13:52:35 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-02-21 17:09:51 -08:00
2026-05-12 11:54:37 +02:00
2026-06-09 13:24:20 +02:00
2025-08-07 10:07:06 +02:00
2025-11-14 10:01:52 +01:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2026-06-18 10:02:13 +02:00
2026-07-06 15:26:17 +02:00
2025-09-24 13:52:35 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-08-10 12:49:04 +02:00
2025-09-12 09:22:45 +02:00
2026-03-19 13:52:56 +01:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2025-09-03 09:38:13 +02:00
2026-02-23 10:41:43 +01:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2023-11-13 17:59:48 +02:00
2026-06-22 10:08:19 +02:00
2025-08-07 10:07:06 +02:00
2026-05-21 10:47:39 +02:00
2026-06-23 10:44:12 +02:00
2025-08-07 10:07:06 +02:00
2026-07-01 09:21:21 +02:00
2026-07-03 07:38:17 +02:00
2026-05-20 15:24:49 +02:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2026-05-28 10:46:46 +02:00
2026-05-28 10:46:46 +02:00
2025-08-07 10:07:06 +02:00
2026-05-28 10:46:46 +02:00
2026-03-25 18:44:36 +01:00
2025-11-25 14:10:07 +01:00
2026-02-23 10:42:14 +01:00
2026-05-20 15:24:49 +02:00
2025-08-11 11:09:23 +02:00
2025-08-07 10:07:06 +02:00
2025-11-25 14:10:07 +01:00
2026-04-23 09:52:15 +02:00
2025-09-24 13:52:35 +02:00
2026-02-23 10:41:43 +01:00
2026-01-28 15:32:16 -05:00
2026-07-03 07:38:17 +02:00
2025-09-12 09:19:56 +02:00
2025-08-07 10:07:06 +02:00
2026-05-11 09:56:28 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2025-08-07 10:07:06 +02:00
2025-09-03 09:38:13 +02:00
2025-08-07 10:07:06 +02:00
2025-09-03 09:38:13 +02:00
2023-08-29 10:21:56 -07:00
2026-07-03 07:38:17 +02:00
2025-11-25 14:10:07 +01:00
2025-09-12 09:19:56 +02:00
2026-04-23 09:53:57 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2025-08-07 10:07:06 +02:00
2026-07-03 07:38:17 +02:00
2026-06-16 07:30:52 +05:30
2025-08-07 10:07:06 +02:00
2026-06-17 08:14:30 +02:00
2025-12-08 05:45:56 +01:00
2025-05-21 12:25:24 +03:00
2026-05-21 12:00:04 +02:00
2026-02-27 10:05:21 +01:00
2026-05-04 09:32:54 +02:00
2026-05-26 11:19:54 +02:00
2025-11-17 10:57:28 +01:00
2026-06-16 07:30:52 +05:30
2026-03-16 09:51:05 +01:00
2026-06-30 16:01:28 +02:00
2026-07-06 15:26:17 +02:00
2026-06-04 15:51:31 +02:00
2022-11-15 11:21:43 +01:00
2026-03-02 10:11:15 +01:00
2026-02-27 10:05:21 +01:00
2026-07-31 10:32:47 +02:00
2026-06-04 15:51:31 +02:00
2026-06-16 08:10:21 +05:30
2026-06-16 08:10:21 +05:30
2026-03-09 10:25:34 +01:00