From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793802573; b=ZG+hSNh1kU5YXVvt40SH/77u77ql0zGPFd6fBxgFFFzQfdlPwBuVT70n95M4PoknfIz1 c/cDdILUvSVKovuHOWOrzEDrJ6b5+3eJG9j63j+lKHpsOo6TCI7Iw/J+mXtVp6uydrRTI PyssQP5VtDCNgw/I+UuyzB8KNnTI9XxVP0oXVrbQHlFHiJEo635glSUPA5Zi1HGrgS+Z6 Lrwex4ZZKyayY1TTWjkksbpRTolDlneMn0Dk9FeHpR9SlR/ng2sXLCe+nfYK4yd/BEQ/g RVa2w69mk71VX6j1xwyIkCskZAmbM7nIO5N75VHDEuoYY6jQTqHxzCx+gBtJsjTSnoQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793802573; h=Received:DKIM-Signature:Subject:To:Cc:From:Date:Message-ID: MIME-Version:Content-Type:Content-Transfer-Encoding; bh=jUe+bQ//Dydq7H8+YOMxEInguf/SKCN2aBbYSiy7MvI=; b=g//3YaBwEear8iIdV4gwHJDCTCyELDdPjjj605WKNtnl5QRfdizZ/2MKEiGygJcjeVEY 1eGSrwiwppwHxP+UpivJyIa/9actLrF29kDsaun+5UFUiDI44dQq2S/7uKougwsVZNnJZ hfeuLavcFQYU5zzO7nEgaLd8FzB2NdvTZcmdKsprpIK8aZzBDosDIHcW7pDbCqluaB2Y/ ShmkqJz6+l3xCmog1fFAfjyk5IIWu+2fHgFIeFY2thtkXXAKv+leVGiBmhEf4BP5d5ca+ QOqkI00E4orWiMButk00aOjsIAG2UdNu46z+T2thyDTMwiLwIRBpWzaYbP9zvgXwWsw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="Dzu/RE0p"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5886B606A333 for ; Wed, 4 Nov 2026 14:29:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Dzu/RE0p Received: by smtp.kernel.org (Postfix) with ESMTPSA id B57FC1F0093A; Wed, 4 Nov 2026 14:29:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793802572; bh=jUe+bQ//Dydq7H8+YOMxEInguf/SKCN2aBbYSiy7MvI=; h=Subject:To:Cc:From:Date; b=Dzu/RE0pNjZ/+7GcREKnqOaCz7y9Nd7EMsHLA7DT01kxlNw70pa3fiXbP7py8namY VDhV5TnKFaUX7ZLgcLzIhRZEUhQhFYzycASSGdoHcmLue7jYhNcVfTht4qQ/FHX4V9 i12ZFBv6xTr5Iv21Rs1xodqhWbo6AWdt95MV/fLA= Subject: FAILED: patch "[PATCH] pps: generators: don't use the driver's info after unregister" failed to apply to 6.18-stable tree To: danishkhateeb03@gmail.com,giometti@enneenne.com,gregkh@linuxfoundation.org Cc: From: Date: Wed, 04 Nov 2026 15:29:31 +0100 Message-ID: <2026110431-imminent-guts-a847@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit The patch below does not apply to the 6.18-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . To reproduce the conflict and resubmit, you may use the following commands: git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y git checkout FETCH_HEAD git cherry-pick -x 4e8063cae337cb7328e6856235cf4de5d165516e # git commit -s git send-email --to '' --in-reply-to '2026110431-imminent-guts-a847@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..' Possible dependencies: thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 4e8063cae337cb7328e6856235cf4de5d165516e Mon Sep 17 00:00:00 2001 From: Danish Khateeb Date: Tue, 29 Sep 2026 07:49:35 -0500 Subject: [PATCH] pps: generators: don't use the driver's info after unregister A file that was opened before pps_gen_unregister_source() keeps pps_gen, and with it the pointer to the driver's pps_gen_source_info. PPS_GEN_SETENABLE and PPS_GEN_USESYSTEMCLOCK keep using that pointer after the driver has gone: - pps_gen_tio allocates its info with devm_kzalloc(), so after an unbind both ioctls read freed memory, and SETENABLE calls the driver's enable() with its freed private data. - pps_gen-dummy does not set info->owner, so it can be unloaded while the file is open, and the ioctls then read the unloaded module's data and call its code. TIO can't probe in a VM, as it needs ART. A test driver that registers its info in devm memory like TIO does, unbound while /dev/pps-gen0 is open, gives: BUG: KASAN: slab-use-after-free in pps_gen_cdev_ioctl+0x4c1/0x580 Read of size 1 at addr ffff88800e647f38 by task ppsgen64/145 ... Freed by task 146: kfree+0x25a/0x6d0 release_nodes+0xd1/0x140 devres_release_all+0x10e/0x1a0 device_unbind_cleanup+0x71/0x250 device_release_driver_internal+0x41b/0x570 unbind_store+0xd9/0x100 and unloading pps_gen-dummy while its file is open oopses: BUG: unable to handle page fault for address: ffffffffa0203040 Oops: Oops: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pps_gen_cdev_ioctl+0x372/0x580 Protect info in the ioctl handler with a mutex, and clear it under the mutex on unregister, so that unregister waits for the ioctls using it and later ones fail with -ENODEV. PPS_KC_BIND does the same for a removed PPS device since commit 3649f9a6b897 ("pps: don't allow PPS_KC_BIND on removed devices"). The sysfs attributes need nothing new: they are removed, and their callbacks drained, before info is cleared. Fixes: 86b525bed275 ("drivers pps: add PPS generators support") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Danish Khateeb Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260929124937.51114-3-danishkhateeb03@gmail.com Signed-off-by: Greg Kroah-Hartman diff --git a/drivers/pps/generators/pps_gen.c b/drivers/pps/generators/pps_gen.c index 059f4fe6c9b4..d80e28dc31dc 100644 --- a/drivers/pps/generators/pps_gen.c +++ b/drivers/pps/generators/pps_gen.c @@ -69,17 +69,28 @@ static long pps_gen_cdev_ioctl(struct file *file, if (ret) return -EFAULT; - ret = pps_gen->info->enable(pps_gen, status); - if (ret) - return ret; - pps_gen->enabled = status; + scoped_guard(mutex, &pps_gen->info_lock) { + if (!pps_gen->info) + return -ENODEV; + + ret = pps_gen->info->enable(pps_gen, status); + if (ret) + return ret; + pps_gen->enabled = status; + } break; case PPS_GEN_USESYSTEMCLOCK: dev_dbg(&pps_gen->dev, "PPS_GEN_USESYSTEMCLOCK\n"); - ret = put_user(pps_gen->info->use_system_clock, uiuarg); + scoped_guard(mutex, &pps_gen->info_lock) { + if (!pps_gen->info) + return -ENODEV; + status = pps_gen->info->use_system_clock; + } + + ret = put_user(status, uiuarg); if (ret) return -EFAULT; @@ -212,6 +223,15 @@ static void pps_gen_unregister_cdev(struct pps_gen_device *pps_gen) { pr_debug("unregistering pps-gen%d\n", pps_gen->id); cdev_device_del(&pps_gen->cdev, &pps_gen->dev); + + /* + * An open file keeps pps_gen around, but the driver may free info as + * soon as we return. The sysfs files are gone now, so wait for the + * ioctls using info and make later ones fail. + */ + scoped_guard(mutex, &pps_gen->info_lock) + pps_gen->info = NULL; + put_device(&pps_gen->dev); } @@ -243,6 +263,7 @@ struct pps_gen_device *pps_gen_register_source(const struct pps_gen_source_info pps_gen->info = info; pps_gen->enabled = false; + mutex_init(&pps_gen->info_lock); init_waitqueue_head(&pps_gen->queue); spin_lock_init(&pps_gen->lock); diff --git a/include/linux/pps_gen_kernel.h b/include/linux/pps_gen_kernel.h index f26f6aac000d..c4d22b1af118 100644 --- a/include/linux/pps_gen_kernel.h +++ b/include/linux/pps_gen_kernel.h @@ -11,6 +11,7 @@ #include #include #include +#include /* * Global defines @@ -44,6 +45,7 @@ struct pps_gen_source_info { /* The main struct */ struct pps_gen_device { const struct pps_gen_source_info *info; /* PSS generator info */ + struct mutex info_lock; /* protects info */ bool enabled; /* PSS generator status */ unsigned int event;