[PATCH 0/8] char: misc: Introduce misc_sync to fix UAF

[Tzung-Bi Shih <tzungbi@kernel.org>]

This series introduces misc_sync to address potential Use-After-Free
errors when a device is deregistered while file operations are still in
progress or files remain open.  It then adopts the mechanism in
cros_ec_chardev driver.

- Patches 1 and 2 are independent refactors in the misc subsystem.
  These are safe cleanups and should be fine to apply.

- Patch 3 is the initial Proof-of-Concept for misc_sync.  It uses a
  global lock to serialize file operations, so a performance downgrade
  is expected.

- Patch 4 is an improvement over the PoC that replaces the global lock
  with SRCU for list traversal in the file operations, avoiding
  performance bottlenecks.

- Patches 5 to 7 are preparation steps in cros_ec_chardev driver.  They
  introduce reference counting for platform driver data and an event
  relayer.  This removes the direct access to `ec_dev->event_notifier`
  in `cros_ec_chardev_release()`, which is a prerequisite for using
  misc_sync safely in this driver.

- Patch 8 switches cros_ec_chardev driver to use misc_sync.

Tzung-Bi Shih (8):
  char: misc: Simplify locking with guard()
  char: misc: Introduce misc_find() helper
  char: misc: Introduce misc_sync_register()
  char: misc: Use SRCU to protect list traversal
  platform/chrome: cros_ec_chardev: Introduce chardev_data
  platform/chrome: cros_ec_chardev: Move data to chardev_pdata
  platform/chrome: cros_ec_chardev: Add event relayer
  platform/chrome: cros_ec_chardev: Use misc_sync_register()

 drivers/char/misc.c                       | 228 +++++++++++++++++-----
 drivers/platform/chrome/cros_ec_chardev.c | 113 ++++++++---
 include/linux/miscdevice.h                |  10 +
 3 files changed, 272 insertions(+), 79 deletions(-)

-- 
2.51.0