Re: [PATCH] debugfs: fix UAF and double-free in debugfs_str read/write

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Sep 25, 2026 at 02:58:27PM -0300, Aldo Ariel Panzardo wrote:
> debugfs_write_file_str() stores the new string via rcu_assign_pointer()
> and frees the old one after synchronize_rcu().  However,
> debugfs_read_file_str() dereferences file->private_data without holding
> an RCU read-side critical section, so synchronize_rcu() in a concurrent
> writer can return—and kfree() the old pointer—before the reader finishes
> using it (use-after-free).
> 
> Additionally, two concurrent writers both read the same `old` pointer
> before either calls rcu_assign_pointer().  When both subsequently call
> kfree(old) a double-free results.
> 
> Fix both issues:
> 
>  - Read path: wrap the pointer dereference and string copy inside
>    rcu_read_lock()/rcu_read_unlock(), using rcu_dereference() and
>    GFP_ATOMIC to keep the allocation within the critical section.
> 
>  - Write path: serialize concurrent writers with inode_lock(), and use
>    rcu_dereference_protected() to read `old` under the held lock.  The
>    lock is released before synchronize_rcu()+kfree() so readers are not
>    blocked during the grace period.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

Did you forget an Assisted-by: tag here?

And how was this found and tested?

And what kernel was tested, debugfs strings were changed a bunch in 7.1,
what bug report are you working off of here?

and shouldn't this be multiple patches as you are doing two different
things?

thanks,

greg k-h