[PATCH v2 0/4] platform/chrome: cros_ec_chardev: Fix a potential UAF
From: Tzung-Bi Shih
Date: Sat May 16 2026 - 10:30:37 EST
This series addresses a potential Use-After-Free error when a device is
deregistered while file operations are still in progress or files remain
open in cros_ec_chardev.
- Patches 1 to 3 are preparation steps in cros_ec_chardev driver. They
introduce reference counting for platform driver data and an event
relayer. This removes the direct access to `ec_dev->event_notifier`
in `cros_ec_chardev_release()`.
- Patch 4 introduces a rwsem for protecting `ec_dev` to prevent the UAF
error.
---
v2:
- Merge patches 5 to 7 from
https://lore.kernel.org/all/20260427134659.95181-1-tzungbi@xxxxxxxxxx.
v1: Doesn't exist.
Tzung-Bi Shih (4):
platform/chrome: cros_ec_chardev: Introduce chardev_data
platform/chrome: cros_ec_chardev: Move data to chardev_pdata
platform/chrome: cros_ec_chardev: Add event relayer
platform/chrome: cros_ec_chardev: Introduce rwsem for protecting
ec_dev
drivers/platform/chrome/cros_ec_chardev.c | 171 +++++++++++++++++-----
1 file changed, 132 insertions(+), 39 deletions(-)
--
2.51.0