linux-doc.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>,
	Tzung-Bi Shih <tzungbi@kernel.org>,
	Benson Leung <bleung@chromium.org>,
	"Rafael J . Wysocki" <rafael@kernel.org>,
	Danilo Krummrich <dakr@kernel.org>,
	Jonathan Corbet <corbet@lwn.net>, Shuah Khan <shuah@kernel.org>,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	chrome-platform@lists.linux.dev, linux-kselftest@vger.kernel.org,
	Bartosz Golaszewski <brgl@bgdev.pl>,
	Wolfram Sang <wsa+renesas@sang-engineering.com>,
	Simona Vetter <simona.vetter@ffwll.ch>,
	Dan Williams <dan.j.williams@intel.com>
Subject: Re: [PATCH v5 5/7] revocable: Add fops replacement
Date: Thu, 11 Dec 2025 12:23:06 +0900	[thread overview]
Message-ID: <20251211032306.GO28860@pendragon.ideasonboard.com> (raw)
In-Reply-To: <2025102321-struggle-fraying-52ff@gregkh>

On Thu, Oct 23, 2025 at 05:04:57PM +0200, Greg KH wrote:
> On Thu, Oct 23, 2025 at 11:51:31AM -0300, Jason Gunthorpe wrote:
> > On Thu, Oct 23, 2025 at 10:22:01PM +0800, Tzung-Bi Shih wrote:
> > 
> > > I was misunderstanding about the "sync" we were discussing for
> > > misc_deregister_sync().  The "sync", is analogous to synchronize_srcu()
> > > of revocable_provider_revoke() in the revocable version [1], doesn't wait
> > > for closing all opened files.
> > 
> > Yes, and my remark is we don't need to obfuscate simple locks in core
> > kernel code.
> 
> {sigh}
> 
> Yes, that's not the goal here at all.
> 
> I've refrained from jumping in as I think we are thinking of different
> stuff here, probably talking past each other in places.
> 
> The original goal of having "revocable" is still needed, despite you
> feeling that cdev can live without it (I strongly disagree with that,
> and the v4l, gpio, i2c, and other subsystem developers have feelings
> along those lines as backed up by the many talks over the years about
> this.)

Replying late to this thread, I don't think this is right for V4L2. When
it comes to solving the .remove() vs. userspace race, I think the right
solution is at the cdev level. We could also implement it exactly the
same way in the V4L2 core, but that would be a shame as other subsystems
would need to replicate the same. There are existing implementations,
they're easy to use in drivers (if implemented in cdev with the little
amount of required driver-logic implemented in the V4L2 core, it would
be mostly transparent for drivers), easy to wrap your head around (no
obscure lifetime magic), and they work.

Where I believe a revocable infrastructure could be useful is for
solving the .remove() vs. *kernel usage* race, which is something GPIO
likely cares about strongly.

> The use of it in the Rust code already is kind of proof of this, it
> enables driver authors to not have to worry about a ton of real-world
> issues they would have to otherwise.  Which is why I suggested copying
> that pattern into C to help us out here.
> 
> Anyway...
> 
> I've been traveling a ton, and it's not going to let up soon, but I'll
> try to dig into this more later next week, or on the next 12+ hour
> flight that I'll be just after that, to give a more detailed review and
> response, sorry I've not been able to do so yet.

-- 
Regards,

Laurent Pinchart

  parent reply	other threads:[~2025-12-11  3:23 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-10-16  5:41 [PATCH v5 0/7] platform/chrome: Fix a possible UAF via revocable Tzung-Bi Shih
2025-10-16  5:41 ` [PATCH v5 1/7] revocable: Revocable resource management Tzung-Bi Shih
2025-10-16  5:41 ` [PATCH v5 2/7] revocable: Add Kunit test cases Tzung-Bi Shih
2025-10-16  5:42 ` [PATCH v5 3/7] selftests: revocable: Add kselftest cases Tzung-Bi Shih
2025-10-16  5:42 ` [PATCH v5 4/7] platform/chrome: Protect cros_ec_device lifecycle with revocable Tzung-Bi Shih
2025-10-16  5:42 ` [PATCH v5 5/7] revocable: Add fops replacement Tzung-Bi Shih
2025-10-16 12:31   ` Jason Gunthorpe
2025-10-17  2:36     ` Tzung-Bi Shih
2025-10-17 13:49       ` Jason Gunthorpe
2025-10-17 16:07         ` Tzung-Bi Shih
2025-10-17 16:21           ` Jason Gunthorpe
2025-10-19 15:08             ` Tzung-Bi Shih
2025-10-20 11:57               ` Jason Gunthorpe
2025-10-21  4:49                 ` Tzung-Bi Shih
2025-10-21 12:15                   ` Jason Gunthorpe
2025-10-23 14:22                     ` Tzung-Bi Shih
2025-10-23 14:51                       ` Jason Gunthorpe
2025-10-23 15:04                         ` Greg Kroah-Hartman
2025-10-23 15:57                           ` Jason Gunthorpe
2025-10-23 16:20                             ` Danilo Krummrich
2025-10-23 16:48                               ` Jason Gunthorpe
2025-10-23 18:30                                 ` Danilo Krummrich
2025-12-11  3:23                           ` Laurent Pinchart [this message]
2025-12-11  3:47                             ` Wolfram Sang
2025-12-11  8:05                               ` Laurent Pinchart
2025-12-11  8:36                                 ` Wolfram Sang
2025-12-11 13:43                                   ` Laurent Pinchart
2025-12-11 14:46                                     ` Tzung-Bi Shih
2025-12-12  8:32                                       ` Tzung-Bi Shih
2025-11-07  4:11                     ` Tzung-Bi Shih
2025-11-07 14:12                       ` Jason Gunthorpe
2025-10-17 16:29           ` Danilo Krummrich
2025-10-17 16:37             ` Jason Gunthorpe
2025-10-17 18:19               ` Danilo Krummrich
2025-10-17 18:44                 ` Jason Gunthorpe
2025-10-17 21:41                   ` Danilo Krummrich
2025-10-17 22:56                     ` Jason Gunthorpe
2025-10-23 15:32                       ` Danilo Krummrich
2025-10-16 18:38   ` Randy Dunlap
2025-10-17  2:41     ` Tzung-Bi Shih
2025-10-16  5:42 ` [PATCH v5 6/7] char: misc: Leverage revocable " Tzung-Bi Shih
2025-10-16  5:42 ` [PATCH v5 7/7] platform/chrome: cros_ec_chardev: Secure cros_ec_device via revocable Tzung-Bi Shih

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251211032306.GO28860@pendragon.ideasonboard.com \
    --to=laurent.pinchart@ideasonboard.com \
    --cc=bleung@chromium.org \
    --cc=brgl@bgdev.pl \
    --cc=chrome-platform@lists.linux.dev \
    --cc=corbet@lwn.net \
    --cc=dakr@kernel.org \
    --cc=dan.j.williams@intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jgg@nvidia.com \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=rafael@kernel.org \
    --cc=shuah@kernel.org \
    --cc=simona.vetter@ffwll.ch \
    --cc=tzungbi@kernel.org \
    --cc=wsa+renesas@sang-engineering.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).