public inbox for chrome-platform@lists.linux.dev
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Tzung-Bi Shih <tzungbi@kernel.org>, Danilo Krummrich <dakr@kernel.org>
Cc: bleung@chromium.org, dawidn@google.com,
	chrome-platform@lists.linux.dev, akpm@linux-foundation.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/3] lib: Add ref_proxy module
Date: Thu, 14 Aug 2025 12:05:32 +0200	[thread overview]
Message-ID: <2025081410-salsa-alabaster-9294@gregkh> (raw)
In-Reply-To: <20250814091020.1302888-2-tzungbi@kernel.org>

On Thu, Aug 14, 2025 at 09:10:18AM +0000, Tzung-Bi Shih wrote:
> Some resources can be removed asynchronously, for example, resources
> provided by a hot-pluggable device like USB.  When holding a reference
> to such a resource, it's possible for the resource to be removed and
> its memory freed, leading to use-after-free errors on subsequent access.
> 
> Introduce the ref_proxy library to establish weak references to such
> resources.  It allows a resource consumer to safely attempt to access a
> resource that might be freed at any time by the resource provider.
> 
> The implementation uses a provider/consumer model built on Sleepable
> RCU (SRCU) to guarantee safe memory access:
> 
>  - A resource provider allocates a struct ref_proxy_provider and
>    initializes it with a pointer to the resource.
> 
>  - A resource consumer that wants to access the resource allocates a
>    struct ref_proxy handle which holds a reference to the provider.
> 
>  - To access the resource, the consumer uses ref_proxy_get().  This
>    function enters an SRCU read-side critical section and returns the
>    pointer to the resource.  If the provider has already freed the
>    resource, it returns NULL.  After use, the consumer calls
>    ref_proxy_put() to exit the SRCU critical section.  The
>    REF_PROXY_GET() is a convenient helper for doing that.
> 
>  - When the provider needs to remove the resource, it calls
>    ref_proxy_provider_free().  This function sets the internal resource
>    pointer to NULL and then calls synchronize_srcu() to wait for all
>    current readers to finish before the resource can be completely torn
>    down.

I've added Danilo here, as hopefully this is doing much the same thing
that his rust code does, but I think it's using different names?
Danilo, any ideas if this matches up with what we have in the driver
core rust code now, and would it help out with the drm drivers as well?

thanks,

greg k-h

  parent reply	other threads:[~2025-08-14 10:05 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-08-14  9:10 [PATCH 0/3] platform/chrome: Fix a possible UAF via ref_proxy Tzung-Bi Shih
2025-08-14  9:10 ` [PATCH 1/3] lib: Add ref_proxy module Tzung-Bi Shih
2025-08-14 10:03   ` Greg KH
2025-08-15  5:35     ` Tzung-Bi Shih
2025-08-14 10:05   ` Greg KH [this message]
2025-08-14 10:27     ` Danilo Krummrich
2025-08-14 10:55   ` Danilo Krummrich
2025-08-15  5:36     ` Tzung-Bi Shih
2025-08-14  9:10 ` [PATCH 2/3] platform/chrome: Protect cros_ec_device lifecycle with ref_proxy Tzung-Bi Shih
2025-08-15 13:37   ` kernel test robot
2025-08-14  9:10 ` [PATCH 3/3] platform/chrome: cros_ec_chardev: Consume cros_ec_device via ref_proxy Tzung-Bi Shih
2025-08-15 21:06   ` kernel test robot
2025-08-16 11:46   ` kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2025081410-salsa-alabaster-9294@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=akpm@linux-foundation.org \
    --cc=bleung@chromium.org \
    --cc=chrome-platform@lists.linux.dev \
    --cc=dakr@kernel.org \
    --cc=dawidn@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=tzungbi@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox