[PATCH] uio: remove the device before releasing its minor

[Xinyou Ji <jerryjilol@gmail.com>]

core-1                            core-2
====================================================================
uio_unregister_device()           __uio_register_device()
  uio_free_minor(minor)
                                    uio_get_minor(idev)
                                    device_add(&idev->dev)
                                      -> -EEXIST
  device_unregister(&idev->dev)
====================================================================

After core-1 releases the minor, core-2 can reuse it before the old
uioN sysfs entry is removed. device_add() then fails with -EEXIST.
This caused TCMU backstore creation failures.

Call device_del() before uio_free_minor() and put_device() afterwards.
This removes the old name before minor reuse while keeping the device
alive until its IDR entry is removed, so concurrent uio_open() cannot
access a freed device.

Fixes: 0c9ae0b86050 ("uio: Fix use-after-free in uio_open")
Link: https://lists.openwall.net/linux-kernel/2026/04/16/709
Cc: stable@vger.kernel.org
Signed-off-by: Xinyou Ji <jerryjilol@gmail.com>

---
Built the 7.4.0-rc2 x86_64 kernel and modules. With 128 workers
repeatedly creating and removing TCMU backstores, the unpatched run
failed to enable a backstore with -EEXIST after 385 successful
create/remove iterations across the workers. Replacing only the UIO
module on the same booted kernel completed 4,350 such iterations and
1,758,183 concurrent read/write operations without -EEXIST.

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index f8fa205..aa93cb9 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -1136,8 +1136,9 @@ void uio_unregister_device(struct uio_info *info)
 	wake_up_interruptible(&idev->wait);
 	kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);
 
+	device_del(&idev->dev);
 	uio_free_minor(minor);
-	device_unregister(&idev->dev);
+	put_device(&idev->dev);
 
 	return;
 }

base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
-- 
2.54.0