mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Shengzhuo Wei <me@cherr.cc>
Cc: sre@kernel.org, kees@kernel.org, linux-kernel@vger.kernel.org,
	Andras Domokos <andras.domokos@nokia.com>,
	Carlos Chinea <carlos.chinea@nokia.com>,
	stable@vger.kernel.org
Subject: Re: [PATCH] HSI: hsi_char: Fix use-after-free on device removal
Date: Thu, 27 Aug 2026 07:43:22 +0200	[thread overview]
Message-ID: <2026082724-nervy-footer-515a@gregkh> (raw)
In-Reply-To: <ao_NyQWCKIDQr_5a@pve>

On Thu, Aug 27, 2026 at 01:40:25PM +0800, Shengzhuo Wei wrote:
> On 2026-08-27 07:15, Greg KH wrote:
> 
> > I'll defer to the hsi maintainers as to what they wish to do here.
> > 
> > Also, how do you remove a hsi device from the system?  Is this on a
> > dynamic bus?  For some reason I didn't think that was possible.
> 
> Yes, HSI is a regular driver-model bus (hsi_bus_type in
> drivers/hsi/hsi_core.c): sysfs unbind and module unload reach
> hsc_remove(), and omap_ssi's own remove() cascades into it through
> hsi_port_unregister_clients(). I verified the unbind path in QEMU
> while auditing the sibling cmt_speech driver, which has the same bug
> and whose fix I'll post separately.

unbind is not a "normal" thing to do, so much so that hopefully the
kernel will be tainted in the future if you do it:
	https://lore.kernel.org/r/20260826-bind_taint-v1-0-52b05f4a965c@linuxfoundation.org

So don't go through lots of work to add code/logic for something that a
normal user can never ever hit.

thanks,

greg k-h

      reply	other threads:[~2026-08-27  5:45 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-26 20:43 Shengzhuo Wei
2026-08-27  4:48 ` Greg KH
2026-08-27  5:09   ` Shengzhuo Wei
2026-08-27  5:15     ` Greg KH
2026-08-27  5:40       ` Shengzhuo Wei
2026-08-27  5:43         ` Greg KH [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2026082724-nervy-footer-515a@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=andras.domokos@nokia.com \
    --cc=carlos.chinea@nokia.com \
    --cc=kees@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=me@cherr.cc \
    --cc=sre@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®