[PATCH 0/8] char: misc: Introduce misc_sync to fix UAF

Tzung-Bi Shih
2026-04-27T13:47:35Z

This series introduces misc_sync to address potential Use-After-Free
errors when a device is deregistered while file operations are still in
progress or files remain open. It then adopts the mechanism in
cros_ec_chardev driver.

- Patches 1 and 2 are independent refactors in the misc subsystem.
These are safe cleanups and should be fine to apply.

- Patch 3 is the initial Proof-of-Concept for misc_sync. It uses a
global lock to serialize file operations, so a performance downgrade
is expected.

- Patch 4 is an improvement over the PoC that replaces the global lock
with SRCU for list traversal in the file operations, avoiding
performance bottlenecks.

- Patches 5 to 7 are preparation steps in cros_ec_chardev driver. They
introduce reference counting for platform driver data and an event
relayer. This removes the direct access to `ec_dev->event_notifier`
in `cros_ec_chardev_release()`, which is a prerequisite for using
misc_sync safely in this driver.

- Patch 8 switches cros_ec_chardev driver to use misc_sync.

Tzung-Bi Shih (8):
char: misc: Simplify locking with guard()
char: misc: Introduce misc_find() helper
char: misc: Introduce misc_sync_register()
char: misc: Use SRCU to protect list traversal
platform/chrome: cros_ec_chardev: Introduce chardev_data
platform/chrome: cros_ec_chardev: Move data to chardev_pdata
platform/chrome: cros_ec_chardev: Add event relayer
platform/chrome: cros_ec_chardev: Use misc_sync_register()

drivers/char/misc.c | 228 +++++++++++++++++-----
drivers/platform/chrome/cros_ec_chardev.c | 113 ++++++++---
include/linux/miscdevice.h | 10 +
3 files changed, 272 insertions(+), 79 deletions(-)

--
2.51.0