Re: [PATCH] misc: phantom: fix open file UAF after device removal

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Aug 31, 2026 at 10:13:26PM +0700, Vu Nguyen Anh Khoa wrote:
> phantom_remove() tears down the character device and frees struct
> phantom_device immediately. Already-open file descriptors still keep
> file->private_data pointing at that object, and their ioctl(), poll(),
> and release() paths remain callable after cdev_del() returns. The VFS
> also performs cdev_put() after ->release(), so freeing a container with
> an embedded cdev leaves an open-file UAF behind.
> 
> Keep the runtime state alive until the last open file is closed, store
> the cdev separately so it can outlive the device state, and block new
> opens while removal is in progress. Mark removed devices so file
> operations fail cleanly without touching unmapped MMIO.
> 
> Assisted-by: LLM (Codex, GPT-5)
> Signed-off-by: Vu Nguyen Anh Khoa <khoavna.tin.2225@gmail.com>
> ---
>  drivers/misc/phantom.c | 123 +++++++++++++++++++++++++++++++----------
>  1 file changed, 93 insertions(+), 30 deletions(-)

Cool, how was this found and tested?

And how was remove() called while the device node was open?  How can
this device be removed while the system is running?


> 
> diff --git a/drivers/misc/phantom.c b/drivers/misc/phantom.c
> index 331cae539290..dcec9c02c426 100644
> --- a/drivers/misc/phantom.c
> +++ b/drivers/misc/phantom.c
> @@ -48,9 +48,11 @@ struct phantom_device {
>  	u32 __iomem *oaddr;
>  	unsigned long status;
>  	atomic_t counter;
> +	unsigned int minor;
> +	bool removed;
>  
>  	wait_queue_head_t wait;
> -	struct cdev cdev;
> +	struct cdev *cdev;
>  
>  	struct mutex open_lock;
>  	spinlock_t regs_lock;
> @@ -60,7 +62,7 @@ struct phantom_device {
>  	u32 ctl_reg;
>  };
>  
> -static unsigned char phantom_devices[PHANTOM_MAX_MINORS];
> +static struct phantom_device *phantom_devices[PHANTOM_MAX_MINORS];
>  
>  static int phantom_status(struct phantom_device *dev, unsigned long newstat)
>  {
> @@ -94,21 +96,31 @@ static long phantom_ioctl(struct file *file, unsigned int cmd,
>  	void __user *argp = (void __user *)arg;
>  	unsigned long flags;
>  	unsigned int i;
> +	long retval = 0;
> +
> +	if (mutex_lock_interruptible(&dev->open_lock))
> +		return -ERESTARTSYS;

guard?

thanks,

greg k-h