From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EAED33B3C11 for ; Wed, 8 Apr 2026 18:19:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672396; cv=none; b=UzbtH8xEc31eV1TdKbVoNN+Tlvt9IcRjqXzdKvd4uEun4CpBLvCPkK9aiTwOG9EZK6C24hhIx+20w4Z54b8FdjMD325YBQmftZiVXczbtA9XqKeeuD4NxRDaONSJO/nzx5yLN4SpK5TDsOUvCCer/MrVWNMbJPENBxuLU+2vVoE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672396; c=relaxed/simple; bh=2Ju/ukdHeFdJOK4wCNooq4KsaMzuv1Wqljc2xbtdj+0=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=pd0w5UCRzUQ06t6v6qWU3FyESdPKTQRsooIJ4AGDblyyazIl/fRHxQa3uNO+5Hk4cJSxXvK6rd7J379gv7gl3hOuMAofyL/cSBX7dbgJ/S/QzlsdU/r7pFkxDRYGZgrWKd/EZEafgknTJ7NbS+PI3752tXjH2vi9I2Eo6rJazsQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Gp1EBnsB; arc=none smtp.client-ip=209.85.216.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Gp1EBnsB" Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-35da2d35eccso55973a91.0 for ; Wed, 08 Apr 2026 11:19:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775672394; x=1776277194; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=FbWIg/vH8cYwEt+dxuazBOhpOULH15nGbf1odlpJ93Y=; b=Gp1EBnsB1vw1kGjJMET6d+AIut8wk/aKUzIYJQihNUEue3/anBsh9VlZ+o64X4c19p Q+v/jVOYop0QYKHUBUWA1jqPuqkxEAgM6X3Y8QTtx4P3NFaqiJw5G7F+GN+09o1gUUos 4skTAh1CkPmCDgyvYuC5N0r2p8cuag+gN90S9c64qODcCvPO1UYff53vZJajhXIx4/Zz iF95ZRGLrymSyFyIbCII1gtWzgx1HA1oQDAvT8EVeybRsZysQJKvS3whspavDvzG51Gd QRO09O6Yl1kTuItZ7tA/NyqMBrlireKC43oQo9wjmgUyVAIfSWUcQFb49i4PS6y8bXrT EKAA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775672394; x=1776277194; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FbWIg/vH8cYwEt+dxuazBOhpOULH15nGbf1odlpJ93Y=; b=hSGHzNMUcIv+VxJSGUlkU3HhrRoJ1mkuL6BOZYYaF3oE5g9sNH+iLyyokzvOmLR2yF 1VCxXpVuLh43jGx9J0pdRk8slF+DnDrsDVx4LDNNwLYm8jBC+ekj2tDLnVug0Fu5+f3h IxWgkBoqk5Nkb8frmwL1wR5iTC7aVgQQ26fmxClOyko70xasiDN36Ml8dGXlgOT7zsJi 062kR5H77M/mGAUIogpsXXt/Kp4kOU+epyytNbk24Cb7808eLhRc8LK3Dk/9PLFkzwUI j8pTJdWLrmDfk99ImoKUomFM15v0GV0YRap+PQw8Hw5UAiW5GkYExXpyqNULH28+IXrj m8+g== X-Forwarded-Encrypted: i=1; AJvYcCUjVplrZhxPNymraND3+2Ku2l5mwhb7fix1ed7IbjPJ1Fq5KSX8zkSdJ8dE7rIjWNuOsS5h0ZSiP4JTEpc=@vger.kernel.org X-Gm-Message-State: AOJu0YxHswOlRaWWXS+7138qcKfS7U3dW9RKNJjKZAGK4v4xaCxRsgV8 0nQq+F1QQ/yBZcCtnVz4k1FMnd4TcPW+kvKWJR06mD8hre2RccjSpO3a X-Gm-Gg: AeBDiet9ReFZc2EToNRd35p0QabyEMLRYc1fiBqox7RSCMXg8NkFZzdqIbK7PwVHBoM y46EVUUEHxOkyElw7fD1REtgB0W6qdt7PEm5T9Jr70BAwtnGsKnVzccfwDk/gY5yJ1fPQw3nZPm 0mwvJG7/GAXRNKly5B6RS3AAHkIg5AwArb3aBwh27PRHGIlCYx0kRTjVTJ0ilwv0EAOruBFee3S pFDShYMpzt8LIT2vPR3f1Zu2fR4aHXlMrY1ossKU1pu3EfOoAS8/Xg1/kaDphp6CHVpacXtuaAQ ntX7XPGiXkKdUH/axxixSIg6plq5qX+Sx7kifhuBfdIVCg0d+IB6SGGT2p8SyAsYxqIdXEJ5kcy n4LsISfzYkkq40W9ODexywFN2txhxw6kOyU8s1rfDthGbWLV6c/fR+4rEYrsNUptfPQo8F1CZZg 5XPqPOWkzOj1eShDjwfzWzG6hnz/vIghokYWRLDv1y14pPWQ== X-Received: by 2002:a17:90b:510c:b0:35d:9482:2233 with SMTP id 98e67ed59e1d1-35e359a4b9fmr338307a91.24.1775672394124; Wed, 08 Apr 2026 11:19:54 -0700 (PDT) Received: from raizudeen ([45.251.33.107]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35e34fc9db1sm372638a91.5.2026.04.08.11.19.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2026 11:19:53 -0700 (PDT) Date: Wed, 8 Apr 2026 23:49:48 +0530 From: Mohamad Raizudeen To: Dmitry Torokhov Cc: kees@kernel.org, linux-kernel@vger.kernel.org, linux-input@vger.kernel.org Subject: Re: [PATCH] Input: serio - fix O(n^2) complexity in serio_unregister_driver() Message-ID: References: <20260408162849.4639-1-raizudeen.kerneldev@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Wed, Apr 08, 2026 at 10:56:26AM -0700, Dmitry Torokhov wrote: > On Wed, Apr 08, 2026 at 11:21:30PM +0530, Mohamad Raizudeen wrote: > > Hi Dmitry, > > Please do not top-post. > > > > > *We do not have such setups at the moment, but what about parent's parent's > > parent?* > > You are right. Even though we don't have such setups today, let me explain > > why the patch works for arbitrary depth. > > > > If we have three ports linked like A->B->C (A is top, B is child of A, C is > > child of B) and all use the same driver. > > What happens if B uses different driver from A? > > > > > C sees its parent B is using the same driver, skip C > > B sees its parent A is using the same driver, skip B > > A has no parent using the same driver, collect A > > > > When we disconnect A, it automatically destroys B and C. So all ports are > > cleaned up. The logic works for any number of levels. > > > > * Could you explain more about the use-after-free scenario?* > > If we collected both A and B, disconnecting A would free B. Then when we > > try to process B from the list, we would use memory that is already freed > > that leads to crash. My patch avoids this by never collecting a port whose > > parent is also using the same driver. > > But currently we restart scanning the list, so there won't be any stale > entries. How would we end up with touching freed memory? > > Thanks. > > -- > Dmitry Thank you for your careful review and for pointing out the mixed driver nestingscenario (A bound to driver X, B bound to driver Y, C bound to driver X). I completely missed that case. You are right my My patch would collect both A and C, then disconnecting A would detroy B and C, leading to a use-after-free when C is later processed from the temporary list. The original goto approach handles this correctly by restarting the scan. I am sorry for sending a flawed patch. I will withdraw it. I will try to deisign a better solution that works for all cases, includes mixed driver nesting, before submitting again. Thank you again for your guidance. Regards, Mohamad Raizudeen.