Re: [PATCH] HSI: hsi_char: Fix use-after-free on device removal

[Greg KH]

On Thu, Aug 27, 2026 at 01:40:25PM +0800, Shengzhuo Wei wrote:
> On 2026-08-27 07:15, Greg KH wrote:
> 
> > I'll defer to the hsi maintainers as to what they wish to do here.
> > 
> > Also, how do you remove a hsi device from the system?  Is this on a
> > dynamic bus?  For some reason I didn't think that was possible.
> 
> Yes, HSI is a regular driver-model bus (hsi_bus_type in
> drivers/hsi/hsi_core.c): sysfs unbind and module unload reach
> hsc_remove(), and omap_ssi's own remove() cascades into it through
> hsi_port_unregister_clients(). I verified the unbind path in QEMU
> while auditing the sibling cmt_speech driver, which has the same bug
> and whose fix I'll post separately.

unbind is not a "normal" thing to do, so much so that hopefully the
kernel will be tainted in the future if you do it:
	https://lore.kernel.org/r/20260826-bind_taint-v1-0-52b05f4a965c@xxxxxxxxxxxxxxxxxxx

So don't go through lots of work to add code/logic for something that a
normal user can never ever hit.

thanks,

greg k-h