Re: [PATCH] HSI: hsi_char: Fix use-after-free on device removal

[Shengzhuo Wei]

On 2026-08-27 07:15, Greg KH wrote:

> I'll defer to the hsi maintainers as to what they wish to do here.
> 
> Also, how do you remove a hsi device from the system?  Is this on a
> dynamic bus?  For some reason I didn't think that was possible.

Yes, HSI is a regular driver-model bus (hsi_bus_type in
drivers/hsi/hsi_core.c): sysfs unbind and module unload reach
hsc_remove(), and omap_ssi's own remove() cascades into it through
hsi_port_unregister_clients(). I verified the unbind path in QEMU
while auditing the sibling cmt_speech driver, which has the same bug
and whose fix I'll post separately.

Thanks for the review, by the way — the second refcount was wrong and
I've withdrawn that approach. For the v2 I'm planning to follow mei's
pattern: an embedded struct device in hsc_client_data as the release
anchor, a cdev_alloc()'ed cdev attached with cdev_set_parent(), the
minor number resolving the container at open, and a device reference
taken in open and dropped in release. One reference count, the
device's; the 16 minors keep sharing one cdev, so userspace sees no
change.

I'll wait for Sebastian's decision on the preferred shape before
sending it.