Re: [PATCH] HSI: hsi_char: Fix use-after-free on device removal

["Shengzhuo Wei" <me@cherr.cc>]

On 2026-08-27 06:48, Greg KH wrote:

> You now have 2 reference counts for the same structure, which is not how
> to handle this at all :(
> 
> Please either make the cdev be a pointer, or use the correct cdev api
> for handling this type of common problem.

Right, adding the kref on top of the embedded cdev was the wrong call.
Thanks for catching it.

I'd like to go with the pointer option, because of how this driver is
structured: one hsc_client_data serves 16 minor numbers through a
single cdev_add(&cl_data->cdev, hsc_dev, HSC_DEVS), and cdev_device_add()
pairs one cdev with one struct device, so switching to it would mean
inventing 16 device objects for no other purpose.

With a dynamically allocated cdev (cdev_alloc() in probe, cdev_del() in
remove), the kobject reference that chrdev_open() already takes on the
cdev would keep the containing object alive until the last file
descriptor is closed, and the final release would go through the cdev's
kobject release callback instead of a hand-written kref — no second
reference count anywhere.

Does that sound like the right direction to you? If so I'll send a v2
along those lines.

Regards,
Shengzhuo