Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2196252/?format=api
{ "id": 2196252, "url": "http://patchwork.ozlabs.org/api/patches/2196252/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-gpio/patch/20260213092958.864411-9-tzungbi@kernel.org/", "project": { "id": 42, "url": "http://patchwork.ozlabs.org/api/projects/42/?format=api", "name": "Linux GPIO development", "link_name": "linux-gpio", "list_id": "linux-gpio.vger.kernel.org", "list_email": "linux-gpio@vger.kernel.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260213092958.864411-9-tzungbi@kernel.org>", "list_archive_url": null, "date": "2026-02-13T09:29:55", "name": "[v3,08/11] gpio: cdev: Leverage revocable for accessing struct gpio_chip", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "950f132c9aedf51b35fbf37cac5ad5272c00e43b", "submitter": { "id": 83557, "url": "http://patchwork.ozlabs.org/api/people/83557/?format=api", "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-gpio/patch/20260213092958.864411-9-tzungbi@kernel.org/mbox/", "series": [ { "id": 492068, "url": "http://patchwork.ozlabs.org/api/series/492068/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-gpio/list/?series=492068", "date": "2026-02-13T09:29:47", "name": "gpio: Adopt revocable mechanism for UAF prevention", "version": 3, "mbox": "http://patchwork.ozlabs.org/series/492068/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2196252/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2196252/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-gpio+bounces-31665-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-gpio@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256\n header.s=k20201202 header.b=WNTrb9sg;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-gpio+bounces-31665-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=\"WNTrb9sg\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=10.30.226.201" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fC6Tc3kwkz1xpl\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 13 Feb 2026 20:35:16 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id 820D13182290\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 13 Feb 2026 09:31:27 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 3DA93330B27;\n\tFri, 13 Feb 2026 09:31:27 +0000 (UTC)", "from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org\n [10.30.226.201])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id EED27342CA7;\n\tFri, 13 Feb 2026 09:31:26 +0000 (UTC)", "by smtp.kernel.org (Postfix) with ESMTPSA id E969BC116C6;\n\tFri, 13 Feb 2026 09:31:23 +0000 (UTC)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1770975087; cv=none;\n b=d+sEIxpNvboiOqZOQRHy8H5X7K1msCQ6ZInFnYEmQTawne0oZjGLn0OTObwvVgJxpczRuIGdfN7syaHp2K1b34kkgg5C2XBFFgHSb+ZCuEpEHgwCM4wKCVLs2ejHs8s4YXwi1T26Jyy5AJGb51kOXZ42OVtt3+ukrzpvZWT6XXE=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1770975087; c=relaxed/simple;\n\tbh=tUJZiJKQBfBigmMk6Pe8ka6NjX4yQ1Z38jqocLE+8Qs=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=MNcUIRXu5wZyQUilrW+sJL5PT/MB5Qw8jn0X/laHgQeoTf87nSjbswEyA3x5YdKqHFu+j71ijvEKycP3hRp8BmNPrpCfEKWRSNeBhmOiTiJMMoThjRJmuAGDizgYBuSFpRvkidQzzv+sHvrJ65CVPFbCYHjlixX0F6uz6CvhVfo=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org\n header.b=WNTrb9sg; arc=none smtp.client-ip=10.30.226.201", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;\n\ts=k20201202; t=1770975086;\n\tbh=tUJZiJKQBfBigmMk6Pe8ka6NjX4yQ1Z38jqocLE+8Qs=;\n\th=From:To:Cc:Subject:Date:In-Reply-To:References:From;\n\tb=WNTrb9sg7prnP8BhIbE8SOF7hf+UYw1Nc3FTKKk5r+i47cgAOHtSuhCYrq/H9EwgM\n\t VkRUu5EGCRVfNwY7Zlr+cTIRPmZgO9YNKmsoJOCxfQqrrrEEhNmIeau4AElI7+i8Ru\n\t fK/q7mQB4/kUYfPn8n2N/RheDD+1zvOxS4P4gwR2+Kj1GuVFdagOqlbo6gpmumSuXs\n\t qaBEN0emqvmYWymgioE4jDVZ7coaggLEIDOFiKZi8daLdNtHLNrxSPjtzRJxTpN7zy\n\t TyLbyvgcaiIwVghXaKfLGZf4o5hSbBPUPQyWqZm9I2R5tzVpE46qERjVH8hbSBThzR\n\t 5Q8aIISuSVcMg==", "From": "Tzung-Bi Shih <tzungbi@kernel.org>", "To": "Bartosz Golaszewski <brgl@kernel.org>,\n\tLinus Walleij <linusw@kernel.org>", "Cc": "Greg Kroah-Hartman <gregkh@linuxfoundation.org>,\n\t\"Rafael J. Wysocki\" <rafael@kernel.org>,\n\tDanilo Krummrich <dakr@kernel.org>,\n\tJonathan Corbet <corbet@lwn.net>,\n\tShuah Khan <shuah@kernel.org>,\n\tLaurent Pinchart <laurent.pinchart@ideasonboard.com>,\n\tWolfram Sang <wsa+renesas@sang-engineering.com>,\n\tJason Gunthorpe <jgg@nvidia.com>,\n\tJohan Hovold <johan@kernel.org>,\n\t\"Paul E . McKenney\" <paulmck@kernel.org>,\n\tDan Williams <dan.j.williams@intel.com>,\n\tchrome-platform@lists.linux.dev,\n\ttzungbi@kernel.org,\n\tlinux-gpio@vger.kernel.org,\n\tlinux-kselftest@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org", "Subject": "[PATCH v3 08/11] gpio: cdev: Leverage revocable for accessing struct\n gpio_chip", "Date": "Fri, 13 Feb 2026 09:29:55 +0000", "Message-ID": "<20260213092958.864411-9-tzungbi@kernel.org>", "X-Mailer": "git-send-email 2.53.0.310.g728cabbaf7-goog", "In-Reply-To": "<20260213092958.864411-1-tzungbi@kernel.org>", "References": "<20260213092958.864411-1-tzungbi@kernel.org>", "Precedence": "bulk", "X-Mailing-List": "linux-gpio@vger.kernel.org", "List-Id": "<linux-gpio.vger.kernel.org>", "List-Subscribe": "<mailto:linux-gpio+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-gpio+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "Struct gpio_device now provides a revocable provider to the underlying\nstruct gpio_chip. Leverage revocable for accessing the struct\ngpio_chip.\n\nSigned-off-by: Tzung-Bi Shih <tzungbi@kernel.org>\n---\nv3:\n- Change revocable API usages accordingly.\n\nv2: https://lore.kernel.org/all/20260203061059.975605-9-tzungbi@kernel.org\n- Change usages accordingly after applying\n https://lore.kernel.org/all/20260129143733.45618-4-tzungbi@kernel.org.\n - Preserve a local storage for `struct revocable`.\n- Combine multiple patches (see \"v1:\").\n- Fix a race condition reported in\n https://lore.kernel.org/all/CAMRc=McDaipt85OHm0MksLkuf6E79dY1uNSqqbcJnoQTUs81Pw@mail.gmail.com/\n and analyzed in\n https://lore.kernel.org/all/aXEEUWwkxHZzCnaI@tzungbi-laptop/.\n In v1, the blocking_notifier_chain_unregister() will be skipped if the\n chip has been removed, leading an UAF in gpiolib_cdev_unregister().\n In v2, it won't skip blocking_notifier_chain_unregister().\n\nv1:\n- https://lore.kernel.org/all/20260116081036.352286-14-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-15-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-16-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-17-tzungbi@kernel.org\n- https://lore.kernel.org/all/20260116081036.352286-18-tzungbi@kernel.org\n\n drivers/gpio/gpiolib-cdev.c | 68 ++++++++++++++-----------------------\n 1 file changed, 26 insertions(+), 42 deletions(-)", "diff": "diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c\nindex 2e3484a89a3b..b491e2737ef2 100644\n--- a/drivers/gpio/gpiolib-cdev.c\n+++ b/drivers/gpio/gpiolib-cdev.c\n@@ -22,6 +22,7 @@\n #include <linux/overflow.h>\n #include <linux/pinctrl/consumer.h>\n #include <linux/poll.h>\n+#include <linux/revocable.h>\n #include <linux/seq_file.h>\n #include <linux/spinlock.h>\n #include <linux/string.h>\n@@ -210,11 +211,9 @@ static long linehandle_ioctl(struct file *file, unsigned int cmd,\n \tDECLARE_BITMAP(vals, GPIOHANDLES_MAX);\n \tunsigned int i;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lh->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lh->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(lh->gdev->chip_rp, gc);\n \n \tswitch (cmd) {\n \tcase GPIOHANDLE_GET_LINE_VALUES_IOCTL:\n@@ -1432,11 +1431,9 @@ static long linereq_ioctl(struct file *file, unsigned int cmd,\n {\n \tstruct linereq *lr = file->private_data;\n \tvoid __user *ip = (void __user *)arg;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(lr->gdev->chip_rp, gc);\n \n \tswitch (cmd) {\n \tcase GPIO_V2_LINE_GET_VALUES_IOCTL:\n@@ -1463,10 +1460,10 @@ static __poll_t linereq_poll(struct file *file,\n {\n \tstruct linereq *lr = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n+\trevocable_try_access_with(lr->gdev->chip_rp, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &lr->wait, wait);\n@@ -1485,11 +1482,9 @@ static ssize_t linereq_read(struct file *file, char __user *buf,\n \tstruct gpio_v2_line_event le;\n \tssize_t bytes_read = 0;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&lr->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(lr->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(lr->gdev->chip_rp, gc);\n \n \tif (count < sizeof(le))\n \t\treturn -EINVAL;\n@@ -1781,10 +1776,10 @@ static __poll_t lineevent_poll(struct file *file,\n {\n \tstruct lineevent_state *le = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n+\trevocable_try_access_with(le->gdev->chip_rp, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &le->wait, wait);\n@@ -1819,11 +1814,9 @@ static ssize_t lineevent_read(struct file *file, char __user *buf,\n \tssize_t bytes_read = 0;\n \tssize_t ge_size;\n \tint ret;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(le->gdev->chip_rp, gc);\n \n \t/*\n \t * When compatible system call is being used the struct gpioevent_data,\n@@ -1901,11 +1894,9 @@ static long lineevent_ioctl(struct file *file, unsigned int cmd,\n \tstruct lineevent_state *le = file->private_data;\n \tvoid __user *ip = (void __user *)arg;\n \tstruct gpiohandle_data ghd;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&le->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(le->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(le->gdev->chip_rp, gc);\n \n \t/*\n \t * We can get the value for an event line but not set it,\n@@ -2434,12 +2425,10 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)\n \tstruct gpio_chardev_data *cdev = file->private_data;\n \tstruct gpio_device *gdev = cdev->gdev;\n \tvoid __user *ip = (void __user *)arg;\n-\n-\tguard(srcu)(&gdev->srcu);\n+\tstruct gpio_chip *gc;\n \n \t/* We fail any subsequent ioctl():s when the chip is gone */\n-\tif (!rcu_access_pointer(gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(gdev->chip_rp, gc);\n \n \t/* Fill in the struct and pass to userspace */\n \tswitch (cmd) {\n@@ -2497,12 +2486,9 @@ static void lineinfo_changed_func(struct work_struct *work)\n \t\t * Pin functions are in general much more static and while it's\n \t\t * not 100% bullet-proof, it's good enough for most cases.\n \t\t */\n-\t\tscoped_guard(srcu, &ctx->gdev->srcu) {\n-\t\t\tgc = srcu_dereference(ctx->gdev->chip, &ctx->gdev->srcu);\n-\t\t\tif (gc &&\n-\t\t\t !pinctrl_gpio_can_use_line(gc, ctx->chg.info.offset))\n+\t\trevocable_try_access_with_scoped(ctx->gdev->chip_rp, gc)\n+\t\t\tif (!pinctrl_gpio_can_use_line(gc, ctx->chg.info.offset))\n \t\t\t\tctx->chg.info.flags |= GPIO_V2_LINE_FLAG_USED;\n-\t\t}\n \t}\n \n \tret = kfifo_in_spinlocked(&ctx->cdev->events, &ctx->chg, 1,\n@@ -2583,10 +2569,10 @@ static __poll_t lineinfo_watch_poll(struct file *file,\n {\n \tstruct gpio_chardev_data *cdev = file->private_data;\n \t__poll_t events = 0;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&cdev->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(cdev->gdev->chip))\n+\trevocable_try_access_with(cdev->gdev->chip_rp, gc);\n+\tif (!gc)\n \t\treturn EPOLLHUP | EPOLLERR;\n \n \tpoll_wait(file, &cdev->wait, pollt);\n@@ -2606,11 +2592,9 @@ static ssize_t lineinfo_watch_read(struct file *file, char __user *buf,\n \tssize_t bytes_read = 0;\n \tint ret;\n \tsize_t event_size;\n+\tstruct gpio_chip *gc;\n \n-\tguard(srcu)(&cdev->gdev->srcu);\n-\n-\tif (!rcu_access_pointer(cdev->gdev->chip))\n-\t\treturn -ENODEV;\n+\trevocable_try_access_or_return(cdev->gdev->chip_rp, gc);\n \n #ifndef CONFIG_GPIO_CDEV_V1\n \tevent_size = sizeof(struct gpio_v2_line_info_changed);\n", "prefixes": [ "v3", "08/11" ] }