[PATCH v2 0/2] gpio: sloppy-logic-analyzer: fix debugfs UAF on unbind

[PATCH v2 0/2] gpio: sloppy-logic-analyzer: fix debugfs UAF on unbind

[Cengiz Can]

Patch 1 fixes a use-after-free. The "trigger" debugfs file uses
debugfs_create_file_unsafe() with a hand-rolled ->write that dereferences
the devres-freed gpio_la_poll_priv without holding a debugfs reference, so
an unbind racing a write frees the object under the handler. Switching to
debugfs_create_file() makes debugfs_remove_recursive() drain the handler
first.

Patch 2 converts the sibling "buf_size" and "capture" files to
debugfs_create_file() as well, for consistency. They were already safe via
DEFINE_DEBUGFS_ATTRIBUTE(); this is the cleanup requested on v1.

v1 was a single patch that fixed only "trigger". v2 splits it so the fix
carries the stable tag on its own, and adds the consistency conversion as a
separate cleanup.

Note: while testing this I found a pre-existing deadlock in the driver
(gpio_la_poll_remove() holds blob_lock across debugfs_remove_recursive(),
which drains the buf_size/capture handlers that also take blob_lock). It is
unrelated to this series; I will send it separately.

Cengiz Can (2):
  gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on
    unbind
  gpio: sloppy-logic-analyzer: use debugfs_create_file() for buf_size
    and capture

 drivers/gpio/gpio-sloppy-logic-analyzer.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.43.0

[PATCH v2 1/2] gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

[Cengiz Can]

The "trigger" debugfs file has a hand-rolled ->write handler
(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
file is created with debugfs_create_file_unsafe(), and the handler never
takes a debugfs reference. Nothing keeps the object alive while the
handler runs.

priv is allocated with devm_kzalloc(). devres frees it when the platform
device is unbound. debugfs_create_file_unsafe() installs no full_proxy
wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
wait for an in-flight trigger_write(). The blob_lock taken there does not
help, because trigger_write() never takes it. A write that races an unbind
therefore writes into freed memory:

  trigger_write()                  gpio_la_poll_remove()
    priv = m->private
    buf = memdup_user()  [may sleep]
                                     mutex_lock(&priv->blob_lock)
                                     debugfs_remove_recursive()  [no wait]
                                     mutex_unlock(&priv->blob_lock)
                                   (remove returns; devres frees priv)
    priv->trig_data = buf   <-- use-after-free write
    priv->trig_len  = count

The race is reachable by root via
/sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.

Create "trigger" with debugfs_create_file() instead. Its full_proxy
wrapper makes debugfs_remove_recursive() drain any in-flight ->write
before it returns.

The use-after-free is confirmed under KASAN with a minimal reproducer of
the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
(available on request); it produces a slab-use-after-free write in the
handler.

Fixes: 7828b7bbbf20 ("gpio: add sloppy logic analyzer using polling")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 drivers/gpio/gpio-sloppy-logic-analyzer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpio/gpio-sloppy-logic-analyzer.c b/drivers/gpio/gpio-sloppy-logic-analyzer.c
index 2bbd308ca08e..c356cf2ed688 100644
--- a/drivers/gpio/gpio-sloppy-logic-analyzer.c
+++ b/drivers/gpio/gpio-sloppy-logic-analyzer.c
@@ -290,7 +290,7 @@ static int gpio_la_poll_probe(struct platform_device *pdev)
 	debugfs_create_ulong("delay_ns_acquisition", 0400, priv->debug_dir, &priv->acq_delay);
 	debugfs_create_file_unsafe("buf_size", 0600, priv->debug_dir, priv, &fops_buf_size);
 	debugfs_create_file_unsafe("capture", 0200, priv->debug_dir, priv, &fops_capture);
-	debugfs_create_file_unsafe("trigger", 0200, priv->debug_dir, priv, &fops_trigger);
+	debugfs_create_file("trigger", 0200, priv->debug_dir, priv, &fops_trigger);
 
 	return 0;
 }
-- 
2.43.0

[PATCH v2 2/2] gpio: sloppy-logic-analyzer: use debugfs_create_file() for buf_size and capture

[Cengiz Can]

The "buf_size" and "capture" debugfs files are created with
debugfs_create_file_unsafe() and DEFINE_DEBUGFS_ATTRIBUTE() fops. That is
safe on its own: debugfs_attr_read()/write() take a debugfs reference
themselves, so debugfs_remove_recursive() drains them on removal.

Now that "trigger" uses debugfs_create_file(), switch these two to the
same call so all three debugfs files in this driver are created uniformly.
This is a cosmetic change; the extra debugfs_file_get()/put() added by the
full_proxy wrapper is negligible.

Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Cengiz Can <cengiz.can@canonical.com>
---
 drivers/gpio/gpio-sloppy-logic-analyzer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpio/gpio-sloppy-logic-analyzer.c b/drivers/gpio/gpio-sloppy-logic-analyzer.c
index c356cf2ed688..017377347295 100644
--- a/drivers/gpio/gpio-sloppy-logic-analyzer.c
+++ b/drivers/gpio/gpio-sloppy-logic-analyzer.c
@@ -288,8 +288,8 @@ static int gpio_la_poll_probe(struct platform_device *pdev)
 	debugfs_create_blob("meta_data", 0400, priv->debug_dir, &priv->meta);
 	debugfs_create_ulong("delay_ns", 0600, priv->debug_dir, &priv->delay_ns);
 	debugfs_create_ulong("delay_ns_acquisition", 0400, priv->debug_dir, &priv->acq_delay);
-	debugfs_create_file_unsafe("buf_size", 0600, priv->debug_dir, priv, &fops_buf_size);
-	debugfs_create_file_unsafe("capture", 0200, priv->debug_dir, priv, &fops_capture);
+	debugfs_create_file("buf_size", 0600, priv->debug_dir, priv, &fops_buf_size);
+	debugfs_create_file("capture", 0200, priv->debug_dir, priv, &fops_capture);
 	debugfs_create_file("trigger", 0200, priv->debug_dir, priv, &fops_trigger);
 
 	return 0;
-- 
2.43.0

Re: [PATCH v2 1/2] gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 2075 bytes --]

On Fri, Jul 31, 2026 at 01:02:57AM +0300, Cengiz Can wrote:
> The "trigger" debugfs file has a hand-rolled ->write handler
> (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The
> file is created with debugfs_create_file_unsafe(), and the handler never
> takes a debugfs reference. Nothing keeps the object alive while the
> handler runs.
> 
> priv is allocated with devm_kzalloc(). devres frees it when the platform
> device is unbound. debugfs_create_file_unsafe() installs no full_proxy
> wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not
> wait for an in-flight trigger_write(). The blob_lock taken there does not
> help, because trigger_write() never takes it. A write that races an unbind
> therefore writes into freed memory:
> 
>   trigger_write()                  gpio_la_poll_remove()
>     priv = m->private
>     buf = memdup_user()  [may sleep]
>                                      mutex_lock(&priv->blob_lock)
>                                      debugfs_remove_recursive()  [no wait]
>                                      mutex_unlock(&priv->blob_lock)
>                                    (remove returns; devres frees priv)
>     priv->trig_data = buf   <-- use-after-free write
>     priv->trig_len  = count
> 
> The race is reachable by root via
> /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.
> 
> Create "trigger" with debugfs_create_file() instead. Its full_proxy
> wrapper makes debugfs_remove_recursive() drain any in-flight ->write
> before it returns.
> 
> The use-after-free is confirmed under KASAN with a minimal reproducer of
> the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern
> (available on request); it produces a slab-use-after-free write in the
> handler.
> 
> Fixes: 7828b7bbbf20 ("gpio: add sloppy logic analyzer using polling")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can@canonical.com>

Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH v2 2/2] gpio: sloppy-logic-analyzer: use debugfs_create_file() for buf_size and capture

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 964 bytes --]

On Fri, Jul 31, 2026 at 01:02:58AM +0300, Cengiz Can wrote:
> The "buf_size" and "capture" debugfs files are created with
> debugfs_create_file_unsafe() and DEFINE_DEBUGFS_ATTRIBUTE() fops. That is
> safe on its own: debugfs_attr_read()/write() take a debugfs reference
> themselves, so debugfs_remove_recursive() drains them on removal.
> 
> Now that "trigger" uses debugfs_create_file(), switch these two to the
> same call so all three debugfs files in this driver are created uniformly.
> This is a cosmetic change; the extra debugfs_file_get()/put() added by the
> full_proxy wrapper is negligible.
> 
> Suggested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
> Assisted-by: Claude:claude-opus-4.8
> Signed-off-by: Cengiz Can <cengiz.can@canonical.com>

I'd squash the patches and keep the stable tag for the combined patch,
but I'll leave this to the GPIO maintainers.

Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]