[PATCH v2 0/6] platform/chrome: cros_ec_chardev: Fix a possible UAF

[Tzung-Bi Shih <tzungbi@kernel.org>]

This is a follow-up series of [1].  It tries to fix a possible UAF in the
fops of cros_ec_chardev after the underlying protocol device has gone by
using kref in struct cros_ec_device.

The 1st patch is a cleanup.

The 2nd patch removes the dependencies of fops to struct cros_ec_dev.  Thus,
it doesn't need to hold a reference to struct cros_ec_dev.

The 3rd patch returns an error when trying to send commands through an
underlying protocol device which either hasn't been registered or has gone.

The 4th patch introduces a new helper cros_ec_device_alloc() for allocating
struct cros_ec_device properly (including to initialize the kref).

The 5th patch lets the fops hold the kref when the file is opening.

The 6th patch starts to manage struct cros_ec_device's lifecycle by the kref.

[1] https://patchwork.kernel.org/project/chrome-platform/patch/20250703113509.2511758-3-tzungbi@kernel.org/

Tzung-Bi Shih (6):
  platform/chrome: cros_ec_chardev: Remove redundant struct field
  platform/chrome: cros_ec_chardev: Decouple fops from struct
    cros_ec_dev
  platform/chrome: Disallow sending commands through unregistered ec_dev
  platform/chrome: Introduce cros_ec_device_alloc()
  platform/chrome: cros_ec_chardev: Hold refcount of struct
    cros_ec_device
  platform/chrome: Manage struct cros_ec_device lifecycle by its
    refcount

 drivers/platform/chrome/cros_ec.c           | 13 +++-
 drivers/platform/chrome/cros_ec_chardev.c   | 74 ++++++++++-----------
 drivers/platform/chrome/cros_ec_i2c.c       |  4 +-
 drivers/platform/chrome/cros_ec_ishtp.c     |  9 ++-
 drivers/platform/chrome/cros_ec_lpc.c       | 11 +--
 drivers/platform/chrome/cros_ec_proto.c     | 53 +++++++++++++++
 drivers/platform/chrome/cros_ec_rpmsg.c     | 20 ++++--
 drivers/platform/chrome/cros_ec_spi.c       | 10 +--
 drivers/platform/chrome/cros_ec_uart.c      | 17 +++--
 include/linux/platform_data/cros_ec_proto.h |  9 +++
 10 files changed, 153 insertions(+), 67 deletions(-)

-- 
2.50.0.727.gbf7dc18ff4-goog