[PATCH v2 0/4] pps: generators: fix use-after-free on unregister with the file open

[Danish Khateeb]

This fixes what goes wrong when a PPS generator is unregistered while
userspace is using it:

1/4: closing the file frees pps_gen in ->release(), and __fput() then
calls cdev_put() on the cdev embedded in it. pps.c had the same bug
before commit c79a39dc8d06 ("pps: Fix a use-after-free"). Fixed with
cdev_device_add().

2/4: the ioctls keep using the driver's pps_gen_source_info: TIO's devm
memory after an unbind, and pps_gen-dummy's module data and code after
an rmmod. They now return -ENODEV, as PPS_KC_BIND does for a removed
PPS device since commit 3649f9a6b897.

3/4: a PPS_GEN_SETENABLE, or a write to "enable", between the driver
stopping its timer and the unregister starts the timer again, and it
then outlives the driver. The core now stops the generator on
unregister.

4/4: a reader in PPS_GEN_FETCHEVENT is now woken up on unregister and
gets -ENODEV, instead of sleeping until a signal.

Yibo Tan's "pps: generators: Pin dummy provider while a file is open"
[1] keeps the dummy module loaded while its file is open. That covers
only the dummy rmmod case; a device such as TIO can still be unbound,
so 2/4 is needed either way.

Changes in v2:
- New 3/4 and 4/4, suggested by Rodolfo.
- 1/4 and 2/4 are unchanged.
- v1: https://lore.kernel.org/all/20260929022219.212024-1-danishkhateeb03@xxxxxxxxx/

[1] https://lore.kernel.org/all/20260911134952.648064-1-lhfff@xxxxxxxxxx/

Danish Khateeb (4):
  pps: generators: fix use-after-free when closing a removed device
  pps: generators: don't use the driver's info after unregister
  pps: generators: stop the generator on unregister
  pps: generators: wake up PPS_GEN_FETCHEVENT readers on unregister

 drivers/pps/generators/pps_gen.c | 111 ++++++++++++++++++++-----------
 include/linux/pps_gen_kernel.h   |   4 +-
 2 files changed, 76 insertions(+), 39 deletions(-)


base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
-- 
2.55.0