Re: [PATCH v2 0/4] pps: generators: fix use-after-free on unregister with the file open

[Rodolfo Giometti <giometti@enneenne.com>]

On Tue, 29 Sep 2026 07:49:33 -0500, Danish Khateeb wrote:
> This fixes what goes wrong when a PPS generator is unregistered while
> userspace is using it:
>
> 1/4: closing the file frees pps_gen in ->release(), and __fput() then
> calls cdev_put() on the cdev embedded in it. pps.c had the same bug
> before commit c79a39dc8d06 ("pps: Fix a use-after-free"). Fixed with
> cdev_device_add().
>
> 2/4: the ioctls keep using the driver's pps_gen_source_info: TIO's devm
> memory after an unbind, and pps_gen-dummy's module data and code after
> an rmmod. They now return -ENODEV, as PPS_KC_BIND does for a removed
> PPS device since commit 3649f9a6b897.
>
> 3/4: a PPS_GEN_SETENABLE, or a write to "enable", between the driver
> stopping its timer and the unregister starts the timer again, and it
> then outlives the driver. The core now stops the generator on
> unregister.
>
> 4/4: a reader in PPS_GEN_FETCHEVENT is now woken up on unregister and
> gets -ENODEV, instead of sleeping until a signal.
>
> Yibo Tan's "pps: generators: Pin dummy provider while a file is open"
> [1] keeps the dummy module loaded while its file is open. That covers
> only the dummy rmmod case; a device such as TIO can still be unbound,
> so 2/4 is needed either way.
>
> Changes in v2:
> - New 3/4 and 4/4, suggested by Rodolfo.
> - 1/4 and 2/4 are unchanged.
> - v1: https://lore.kernel.org/all/20260929022219.212024-1-danishkhateeb03@gmail.com/
>
> [1] https://lore.kernel.org/all/20260911134952.648064-1-lhfff@tju.edu.cn/
>
> Danish Khateeb (4):
>   pps: generators: fix use-after-free when closing a removed device
>   pps: generators: don't use the driver's info after unregister
>   pps: generators: stop the generator on unregister
>   pps: generators: wake up PPS_GEN_FETCHEVENT readers on unregister
>
>  drivers/pps/generators/pps_gen.c | 111 ++++++++++++++++++++-----------
>  include/linux/pps_gen_kernel.h   |   4 +-
>  2 files changed, 76 insertions(+), 39 deletions(-)
>
>
> base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e

Thanks for picking up both points, and for testing them.

For the whole series:

Acked-by: Rodolfo Giometti <giometti@enneenne.com>

Ciao,

Rodolfo