From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f41.google.com (mail-qv1-f41.google.com [209.85.219.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0D83B3BF696 for ; Tue, 30 Jun 2026 19:27:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782847642; cv=none; b=RG4XUiElY4p2cGi4RuO3SE71/9e1fxhjMLqMWV/MVblakP26SQGJYKyYSpMoKx64gFipcgba3oNYIVEBFQkDGWfZ7bhqo2hjnzeX/j/NXO9jh4NPdq1x2F0V/sz8bOg2Xqc+WTzW/EUt6IsqNR+tXvxkxMRd4lZNfmkl3AwsAA4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782847642; c=relaxed/simple; bh=hsJzkf+SyxZp4oPeNhr8A0uw3mqL3TjR8U10bLTj6Wo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Clyca+HedYY4+sqrEeix8WcXly1wClpRuu7FdREPgnXWcK3p52yNh0BmVAACXL7nHbq9vorV79JP/RmCCWLQB/x2q/7FiShu3nFxAV0f3sc7r2/VDa0M5dUTjmaHhZHsLczzuVwKU6MzQlHgGUGBU6uGnP+owo222LB2LS9KxOw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oIHV1bSE; arc=none smtp.client-ip=209.85.219.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oIHV1bSE" Received: by mail-qv1-f41.google.com with SMTP id 6a1803df08f44-8efef6533aaso28461916d6.0 for ; Tue, 30 Jun 2026 12:27:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782847639; x=1783452439; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=3vqeME7dm7npJ5ALpGCsVFyOGEm2EgBzjPWk7KRi88Y=; b=oIHV1bSEegu/QcEEIvxRhI/MyntiU2Y5XX81iszj4XOClarcvhgdUIF4KyMfFZvCWb Ru1EUbMC6cxwbfCrRj/NTnga6SFf3AQ4YyaBtHjJu2AC0qpJ2uNsqrhAvTUGLWzwEG7M Xble1TaiID0DdKma5PdCwfxK+443gq61NgTMCloo9wcTbf3/y9LWaORDtomyyG37lkAw W1/vogdeciFIyw9PZNYhxJG+WVJdPcvqzRzxhlUKIum8AOrKGhuV91/wr1z2KGTqnEhK xLDwMwPFgoPqsCoRqffRma8smYdV7vP3Sscw0ynSnFCFZw+Hzw3nIl36ldLVKAKsNSmi /MPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782847639; x=1783452439; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=3vqeME7dm7npJ5ALpGCsVFyOGEm2EgBzjPWk7KRi88Y=; b=msv7zHjE1vj4OXUzsGo3CyO8QQgmxIQH8mHjhE3kXqFBl6174sGvVeFxM0f1fq5f/z xU20di5x2P6URtOjf071J7rJfXWXJttSVUgW9u/vZpehdiIs12uGYspMlfm4lpfNq9P7 tCXi5b8Om4gozpNJcrDcYc7EOCzD9X1e34rDE+SQqBk/ybiIxwMpTYHo9bk1L5idAUY8 KsBQ+6ZlQlX2BCU6sAXeBoyjSa9omWzeHmcssXKsY6LwFCGrRdnBTPA5G4MbzL6lsvoD NgaF34jcRS1IHfsvBZrkL6JIMfbmLCa1tM+IhGm67SP7saNJ2VcqcUCmSkA8xD8EsXsD PguA== X-Gm-Message-State: AOJu0YywoElsU3DCrMcI/zHIsLASIYGtl/m2tpAik8kILUYi3LToEA44 soWeuoCTxD21acn3iZG3BvPDgQ6JRGcEDRb7/I2f4YJdRSeo9IolM73u X-Gm-Gg: AfdE7clTLeC9G4lxJARa7tTbP0p6l00Uk0UIvS33ez1LlIMPGlf+jD9kivm+woHKjoo i9dwobIQVjJvwQ2ZLGwaTML86/zcaPZynq9V3L7VfhlWwPCfrku68CMzwFqvcNf8Efo4NC8ljyJ EGksVNYvkyFa5cLSiOlWKdGZ9ihtT/M1QHgylDeNxeruooPU5pY2tBpxLAitTcSylICMgv0eRQg vc4gzYeB38NLnTHvIRpGuIoE/5KhL7fNJ8mh+vIqrzuP8vY58ykEcps/122OzOS81QCI5SxZiy6 fTKsjokHLdmjIp4fz8umyK0qJ77bi9CDgG8vEcRgRvmSU/6Z7cP5I210khDrO5+HK6S5pbk3liw eoTeoqeXXQDpdDRAcbeVoQrK/Hzwe8InvmsEwvsx+IyYs4rz1UpE7Gv/ilmzQ5zflRB4QIDQTpJ aeKTmiGRE/p4jjWvaNrM/GsX25IIMmMo/TltvcvKE1 X-Received: by 2002:a05:6214:dad:b0:8f2:9be8:f444 with SMTP id 6a1803df08f44-8f29be91ff1mr35615166d6.8.1782847638757; Tue, 30 Jun 2026 12:27:18 -0700 (PDT) Received: from i4-gl-tmk5904.ad.psu.edu ([130.203.156.186]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8f1a69c283fsm32868836d6.26.2026.06.30.12.27.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Jun 2026 12:27:18 -0700 (PDT) From: Yuho Choi To: Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Yuho Choi Subject: [PATCH v1] uio: Fix stale info pointer in failed registration path Date: Tue, 30 Jun 2026 15:27:14 -0400 Message-ID: <20260630192714.1867170-1-dbgh9129@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit After device_add(), the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, __uio_register_device() unwinds the device but leaves idev->info pointing at the caller-owned struct uio_info. That is unsafe when an opener races with the failed registration path. The open file keeps a reference to the uio_device, while the caller sees registration failure and may free its struct uio_info. Later file operations can then follow idev->info and dereference freed memory. Handle post-device_add() failures like unregister: remove UIO attributes while the info pointer is still valid, then clear idev->info under info_lock and wake existing waiters/async users before removing the device and minor. This makes already-open file descriptors observe the same "device gone" state as normal uio_unregister_device(). Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") Signed-off-by: Yuho Choi --- drivers/uio/uio.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c index 1e4ade78ed84..e77d5e7d5f64 100644 --- a/drivers/uio/uio.c +++ b/drivers/uio/uio.c @@ -1057,6 +1057,11 @@ int __uio_register_device(struct module *owner, err_request_irq: uio_dev_del_attributes(idev); err_uio_dev_add_attributes: + mutex_lock(&idev->info_lock); + idev->info = NULL; + mutex_unlock(&idev->info_lock); + wake_up_interruptible(&idev->wait); + kill_fasync(&idev->async_queue, SIGIO, POLL_HUP); device_del(&idev->dev); err_device_create: uio_free_minor(idev->minor); -- 2.43.0