On Tue, Oct 05, 2021 at 08:40:35AM +0800, Kent Gibson wrote: > On Mon, Oct 04, 2021 at 10:56:00PM +0300, Andy Shevchenko wrote: > > On Mon, Oct 4, 2021 at 8:51 PM Kent Gibson <warthog618@xxxxxxxxx> wrote: ... > > Here is debug prints of what happens > > > > # modprobe gpio-mockup gpio_mockup_ranges=-1,10 > > [ 212.850993] (null): device_create_managed_software_node <<< 0 > > [ 212.858177] platform gpio-mockup.0: software_node_notify 0 <<< > > [ 212.865264] platform gpio-mockup.0: software_node_notify 1 <<< 1 > > [ 212.874159] gpio-mockup gpio-mockup.0: no of_node; not parsing pinctrl DT > > [ 212.882962] gpiochip_find_base: found new base at 840 > > [ 212.889873] gpio gpiochip3: software_node_notify 0 <<< > > [ 212.896164] gpio gpiochip3: software_node_notify 1 <<< 1 > > [ 212.905099] gpio gpiochip3: (gpio-mockup-A): added GPIO chardev (254:3) > > [ 212.913313] gpio gpiochip840: software_node_notify 0 <<< > > [ 212.920676] gpio gpiochip3: registered GPIOs 840 to 849 on gpio-mockup-A > > [ 212.935601] modprobe (185) used greatest stack depth: 12744 bytes left > > > > As I read it the software node is created for gpio-mockup device and > > then _shared_ with the GPIO device, since it's managed it's gone when > > GPIO device gone followed by UAF when mockup (platform) device itself > > gone. I.o.w. this software node mustn't be managed because it covers > > the lifetime of two different objects. The correct fix is to create > > manually software node and assign it to the pdev and manually free in > > gpio_mockup_unregister_pdevs()/ > > > > Tl;DR: it's a bug in gpio-mockup. > > So the bug is in the behaviour of gpio_mockup_register_chip()? Not really. The utter root cause is the former API (device_add_properties() et al) which Heikki is getting rid of in particular because of this issue, i.e. when users blindly call it without fully understanding the picture of the object lifetimes. > That is out of my court, so I'll leave it to you and Bart to sort out. I'll see what I can do about. -- With Best Regards, Andy Shevchenko
