Re: [PATCH v5 6/8] gpio: cdev: put emitting the line state events on a workqueue

["Sverdlin, Alexander" <alexander.sverdlin@siemens.com>]

Hi Bartosz,

On Fri, 2025-11-14 at 09:21 +0100, Bartosz Golaszewski wrote:
> > > In order to allow line state notifications to be emitted from atomic
> > > context (for instance: from gpiod_direction_input/output()), we must
> > > stop calling any sleeping functions in lineinfo_changed_notify(). To
> > > that end let's use the new workqueue.
> > > 
> > > Let's atomically allocate small structures containing the required data
> > > and fill it with information immediately upon being notified about the
> > > change except for the pinctrl state which will be retrieved later from
> > > process context. We can pretty reliably do this as pin functions are
> > > typically set once per boot.
> > > 
> > > Let's make sure to bump the reference count of GPIO device and the GPIO
> > > character device file descriptor to keep both alive until the event was
> > > queued.
> > > 
> > > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > 
> > starting from this patch up to the current linux-next (v6.18-rcX)
> > I see the following refcnt warnings + KASAN UAF reports on either reboot
> > (when gpio-manager is being stopped) or
> > `systemctl kill --signal=SIGKILL gpio-manager` (if some GPIOs are being
> > requested from (owned by) gpio-manager prior to kill):

[]

> Thanks for the bug report. I confirm it's reproducible on my side too.
> It never occurred to me to try and SIGKILL gpio-manager. On normal
> exit, nothing bad happens. Let me look into it.

In my case it happens also on every reboot/shutdown, however if I
`systemctl stop gpio-manager`, I don't see the issue... not sure yet,
what is the difference... and I'm not telling SIGKILL is how one
should stop gpio-manager, but I'm happy SIGKILL now allows you to
reproduce the issue in the kernel code!

> Do you also go by ccpalex on github? I want to give you credit for
> reporting the other bug in gpio-manager as well.

That's me! I didn't know where to report an issue with user-space libgpiod,
that's why I went with github ;-)

-- 
Alexander Sverdlin
Siemens AG
www.siemens.com