Re: [PATCH v3 0/4] platform/chrome: cros_ec_chardev: Fix a potential UAF

[Tzung-Bi Shih]

On Mon, May 25, 2026 at 05:26:50AM +0000, Tzung-Bi Shih wrote:
>   This series addresses a potential Use-After-Free error when a device is
> deregistered while file operations are still in progress or files remain
> open in cros_ec_chardev.
> 
> - Patches 1 to 3 are preparation steps in cros_ec_chardev driver.  They
>   introduce reference counting for platform driver data and an event
>   relayer.  This removes the direct access to `ec_dev->event_notifier`
>   in `cros_ec_chardev_release()`.
> - Patch 4 introduces a rwsem for protecting `ec_dev` to prevent the UAF
>   error.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/4] platform/chrome: cros_ec_chardev: Introduce chardev_data
      commit: 5ad1406881102bc3e94fd25311d1728dfaf435a2
[2/4] platform/chrome: cros_ec_chardev: Move data to chardev_pdata
      commit: 74aa0d4008051878c632530f2a2c13cff8e9b171
[3/4] platform/chrome: cros_ec_chardev: Add event relayer
      commit: 6c1977b1f760d7ec71da78781f1d9eeb7a0e21f2
[4/4] platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
      commit: 77750c0d8d837f59ad6ecde0157fd245ff3f3421

Thanks!