[PATCH v2 0/3] iio: adis: fix unprotected debugfs reads

[PATCH v2 0/3] iio: adis: fix unprotected debugfs reads

[Arka Mondal]

Four open coded file operations in three ADIS drivers are passed to
debugfs_create_file_unsafe(). None of them call debugfs_file_get(), so
debugfs_remove_recursive() does not wait for a read in progress and
unbind frees the iio_dev underneath it.

Andy Shevchenko <andriy.shevchenko@intel.com> asked on v1 whether these
could use DEFINE_DEBUGFS_ATTRIBUTE() instead. They cannot, as it formats
a single u64, and these handlers print up to four registers, e.g.
"%.4x%.4x%.4x-%.4x" in adis16136. Converting them would change what the
files return.

adis16475 and adis16550 already split this way, using
debugfs_create_file() for their open coded firmware files and
debugfs_create_file_unsafe() only for the DEFINE_DEBUGFS_ATTRIBUTE ones.
This does the same for adis16480, adis16400 and adis16136.

Compile tested only; no ADIS hardware available.

Changes since v1:
1. patch 2: changelog rewritten to explain why serial_number cannot use
   DEFINE_DEBUGFS_ATTRIBUTE(). Code unchanged.
2. patches 1 and 3: unchanged, Reviewed-by added.

Link to v1:
https://lore.kernel.org/r/20260814090728.965922-1-arkamondalofficial@gmail.com

Arka Mondal (3):
  iio: imu: adis16480: fix unprotected debugfs reads
  iio: imu: adis16400: fix unprotected debugfs reads
  iio: gyro: adis16136: fix unprotected debugfs reads

 drivers/iio/gyro/adis16136.c | 2 +-
 drivers/iio/imu/adis16400.c  | 2 +-
 drivers/iio/imu/adis16480.c  | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)


base-commit: 3d6d817622b0a9721e3cc404df3469171582be13
-- 
2.55.0

[PATCH v2 1/3] iio: imu: adis16480: fix unprotected debugfs reads

[Arka Mondal]

The firmware_revision and firmware_date file operations are open coded
and never call debugfs_file_get(), which debugfs_create_file_unsafe()
requires. debugfs_remove_recursive() therefore does not wait for a read
in progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Fixes: 9bf94f836e32 ("imu:adis16480: fix debugfs_simple_attr.cocci warnings")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
---

Notes:
    Compile tested only; no relevant hardware available.

 drivers/iio/imu/adis16480.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
index e009f3824768..254b7ff25b66 100644
--- a/drivers/iio/imu/adis16480.c
+++ b/drivers/iio/imu/adis16480.c
@@ -309,9 +309,9 @@ static void adis16480_debugfs_init(struct iio_dev *indio_dev)
 	if (!IS_ENABLED(CONFIG_DEBUG_FS))
 		return;
 
-	debugfs_create_file_unsafe("firmware_revision", 0400,
+	debugfs_create_file("firmware_revision", 0400,
 		d, adis16480, &adis16480_firmware_revision_fops);
-	debugfs_create_file_unsafe("firmware_date", 0400,
+	debugfs_create_file("firmware_date", 0400,
 		d, adis16480, &adis16480_firmware_date_fops);
 	debugfs_create_file_unsafe("serial_number", 0400,
 		d, adis16480, &adis16480_serial_number_fops);
-- 
2.55.0

[PATCH v2 2/3] iio: imu: adis16400: fix unprotected debugfs reads

[Arka Mondal]

adis16400_serial_number_fops is open coded and never calls
debugfs_file_get(), so debugfs_remove_recursive() does not wait for a
read in progress and unbind frees the iio_dev underneath it.

Commit ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE
instead of DEFINE_SIMPLE_ATTRIBUTE") converted product_id and
flash_count to DEFINE_DEBUGFS_ATTRIBUTE, which protects itself, but
moved all three files to debugfs_create_file_unsafe().

serial_number prints three registers as "%.4x-%.4x-%.4x" and
DEFINE_DEBUGFS_ATTRIBUTE() formats a single u64, so it cannot be
converted without changing what the file returns. adis16475 and
adis16550 already use debugfs_create_file() for their open coded
files. Use it here too.

Fixes: ae1d37a9bb4b ("iio: imu: adis16400: use DEFINE_DEBUGFS_ATTRIBUTE instead of DEFINE_SIMPLE_ATTRIBUTE")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
---

Notes:
    Compile tested only; no relevant hardware available.

 drivers/iio/imu/adis16400.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c
index 36323ad149e0..7e85c1b8dc16 100644
--- a/drivers/iio/imu/adis16400.c
+++ b/drivers/iio/imu/adis16400.c
@@ -280,7 +280,7 @@ static void adis16400_debugfs_init(struct iio_dev *indio_dev)
 		return;
 
 	if (st->variant->flags & ADIS16400_HAS_SERIAL_NUMBER)
-		debugfs_create_file_unsafe("serial_number", 0400,
+		debugfs_create_file("serial_number", 0400,
 				d, st, &adis16400_serial_number_fops);
 	if (st->variant->flags & ADIS16400_HAS_PROD_ID)
 		debugfs_create_file_unsafe("product_id", 0400,
-- 
2.55.0

[PATCH v2 3/3] iio: gyro: adis16136: fix unprotected debugfs reads

[Arka Mondal]

The serial_number file operations are open coded and never call
debugfs_file_get(), which debugfs_create_file_unsafe() requires.
debugfs_remove_recursive() therefore does not wait for a read in
progress, and unbind frees the iio_dev underneath it.

Use debugfs_create_file() instead.

Fixes: 9aaea09b4cbd ("gyro:adis16136: fix debugfs_simple_attr.cocci warnings")
Signed-off-by: Arka Mondal <arkamondalofficial@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
---

Notes:
    Compile tested only; no relevant hardware available.

 drivers/iio/gyro/adis16136.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/gyro/adis16136.c b/drivers/iio/gyro/adis16136.c
index 369c7428e1ef..adcf54b67a28 100644
--- a/drivers/iio/gyro/adis16136.c
+++ b/drivers/iio/gyro/adis16136.c
@@ -145,7 +145,7 @@ static int adis16136_debugfs_init(struct iio_dev *indio_dev)
 	struct adis16136 *adis16136 = iio_priv(indio_dev);
 	struct dentry *d = iio_get_debugfs_dentry(indio_dev);
 
-	debugfs_create_file_unsafe("serial_number", 0400,
+	debugfs_create_file("serial_number", 0400,
 		d, adis16136, &adis16136_serial_fops);
 	debugfs_create_file_unsafe("product_id", 0400,
 		d, adis16136, &adis16136_product_id_fops);
-- 
2.55.0

Re: [PATCH v2 0/3] iio: adis: fix unprotected debugfs reads

[Jonathan Cameron]

On Sun, 16 Aug 2026 03:27:23 +0900
Arka Mondal <arkamondalofficial@gmail.com> wrote:

> Four open coded file operations in three ADIS drivers are passed to
> debugfs_create_file_unsafe(). None of them call debugfs_file_get(), so
> debugfs_remove_recursive() does not wait for a read in progress and
> unbind frees the iio_dev underneath it.
> 
> Andy Shevchenko <andriy.shevchenko@intel.com> asked on v1 whether these
> could use DEFINE_DEBUGFS_ATTRIBUTE() instead. They cannot, as it formats
> a single u64, and these handlers print up to four registers, e.g.
> "%.4x%.4x%.4x-%.4x" in adis16136. Converting them would change what the
> files return.
> 
> adis16475 and adis16550 already split this way, using
> debugfs_create_file() for their open coded firmware files and
> debugfs_create_file_unsafe() only for the DEFINE_DEBUGFS_ATTRIBUTE ones.
> This does the same for adis16480, adis16400 and adis16136.

This all makes sense to me, so I've queued this on the fixes-togreg
branch of iio.git and marked them for stable.  Note that branch will be
rebased on rc1 once available.  As such I don't really mind rebasing
it for tags or any feedback that comes in.

Thanks

Jonathan

> 
> Compile tested only; no ADIS hardware available.
> 
> Changes since v1:
> 1. patch 2: changelog rewritten to explain why serial_number cannot use
>    DEFINE_DEBUGFS_ATTRIBUTE(). Code unchanged.
> 2. patches 1 and 3: unchanged, Reviewed-by added.
> 
> Link to v1:
> https://lore.kernel.org/r/20260814090728.965922-1-arkamondalofficial@gmail.com
> 
> Arka Mondal (3):
>   iio: imu: adis16480: fix unprotected debugfs reads
>   iio: imu: adis16400: fix unprotected debugfs reads
>   iio: gyro: adis16136: fix unprotected debugfs reads
> 
>  drivers/iio/gyro/adis16136.c | 2 +-
>  drivers/iio/imu/adis16400.c  | 2 +-
>  drivers/iio/imu/adis16480.c  | 4 ++--
>  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> 
> base-commit: 3d6d817622b0a9721e3cc404df3469171582be13