linux-kernel - Re: [PATCH v5 6/8] gpio: cdev: put emitting the line state events on a workqueue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMRc=McswuxryKqh7-zSc+oKTubu-bKoV40mUMh1tUbTofHA5A@mail.gmail.com>
Date: Fri, 14 Nov 2025 09:21:15 +0100
From: Bartosz Golaszewski <brgl@...ev.pl>
To: "Sverdlin, Alexander" <alexander.sverdlin@...mens.com>
Cc: "warthog618@...il.com" <warthog618@...il.com>, 
	"linus.walleij@...aro.org" <linus.walleij@...aro.org>, 
	"bartosz.golaszewski@...aro.org" <bartosz.golaszewski@...aro.org>, 
	"linux-gpio@...r.kernel.org" <linux-gpio@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v5 6/8] gpio: cdev: put emitting the line state events on
 a workqueue

On Thu, Nov 13, 2025 at 10:11 PM Sverdlin, Alexander
<alexander.sverdlin@...mens.com> wrote:
>
> Hello Bartosz,
>
> On Fri, 2024-10-18 at 11:10 +0200, Bartosz Golaszewski wrote:
> > From: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
> >
> > In order to allow line state notifications to be emitted from atomic
> > context (for instance: from gpiod_direction_input/output()), we must
> > stop calling any sleeping functions in lineinfo_changed_notify(). To
> > that end let's use the new workqueue.
> >
> > Let's atomically allocate small structures containing the required data
> > and fill it with information immediately upon being notified about the
> > change except for the pinctrl state which will be retrieved later from
> > process context. We can pretty reliably do this as pin functions are
> > typically set once per boot.
> >
> > Let's make sure to bump the reference count of GPIO device and the GPIO
> > character device file descriptor to keep both alive until the event was
> > queued.
> >
> > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@...aro.org>
>
> starting from this patch up to the current linux-next (v6.18-rcX)
> I see the following refcnt warnings + KASAN UAF reports on either reboot
> (when gpio-manager is being stopped) or
> `systemctl kill --signal=SIGKILL gpio-manager` (if some GPIOs are being
> requested from (owned by) gpio-manager prior to kill):
>

Hi!

Thanks for the bug report. I confirm it's reproducible on my side too.
It never occurred to me to try and SIGKILL gpio-manager. On normal
exit, nothing bad happens. Let me look into it.

Do you also go by ccpalex on github? I want to give you credit for
reporting the other bug in gpio-manager as well.

Bartosz