Re: [PATCH] gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
From: Cengiz Can
Date: Tue Jul 28 2026 - 11:24:48 EST
On 7/28/26 12:47, Wolfram Sang wrote:
>
>> debugfs_create_file_unsafe("buf_size", 0600, priv->debug_dir, priv, &fops_buf_size);
>> debugfs_create_file_unsafe("capture", 0200, priv->debug_dir, priv, &fops_capture);
>> - debugfs_create_file_unsafe("trigger", 0200, priv->debug_dir, priv, &fops_trigger);
>> + debugfs_create_file("trigger", 0200, priv->debug_dir, priv, &fops_trigger);
>
> What about removing the other _unsafe calls as well? TBH, I can't recall
> why I used them. Doesn't make sense from today's perspective.
I checked those too, but buf_size and capture are fine as they are.
They use DEFINE_DEBUGFS_ATTRIBUTE(), whose read/write paths take a debugfs
reference (debugfs_file_get()/put()) around the access. So they already
hold a reference and removal waits for them.
Switching them to debugfs_create_file() would just add a second
get/put around the one they already do, so I would leave them.
Happy to send a follow-up if you'd prefer them consistent.
Thanks!