Re: [PATCH] gpiolib: keep the line state workqueue alive until device release

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] gpiolib: double destroy_workqueue() in gpiodev_release() on
  cdev add error
--

commit f0714550a8f7080c7dd00f07240622c9dd77f912
Author: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>

gpiolib: keep the line state workqueue alive until device release

This commit moves the destruction of gdev->line_state_wq from
gpiolib_cdev_unregister() to gpiodev_release() to avoid a use-after-free
race with concurrent gpiod_line_state_notify() calls during chip removal.

> diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
> index fbdeda2f27871..c954c7eec2bee 100644
> --- a/drivers/gpio/gpiolib.c
> +++ b/drivers/gpio/gpiolib.c

[ ... ]

> @@ -898,6 +899,9 @@ static void gpiodev_release(struct device *dev)
>  	synchronize_srcu(&gdev->desc_srcu);
>  	cleanup_srcu_struct(&gdev->desc_srcu);
>  
> +	if (gdev->line_state_wq)
> +		destroy_workqueue(gdev->line_state_wq);

[Severity: Medium]
Can this call destroy_workqueue() a second time on gdev->line_state_wq if
cdev_device_add() fails in gpiolib_cdev_register()?

drivers/gpio/gpiolib-cdev.c:gpiolib_cdev_register() {
	...
	ret = cdev_device_add(&gdev->chrdev, &gdev->dev);
	if (ret) {
		destroy_workqueue(gdev->line_state_wq);
		return ret;
	}
	...
}

When gpiolib_cdev_register() fails here, it destroys gdev->line_state_wq
without clearing the pointer.  The caller then unwinds via
gpio_device_put(gdev) -> gpiodev_release(), which sees the non-NULL
dangling pointer and calls destroy_workqueue() again, causing a
use-after-free.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-gpio-line-state-wq-uaf-v1-1-2e126ca3427d@oss.qualcomm.com?part=1