]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
gpio: virtuser: fix UAF in configfs release path
authorYuhao Huang <nekowong743@gmail.com>
Mon, 26 Jan 2026 04:03:48 +0000 (12:03 +0800)
committerBartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tue, 27 Jan 2026 19:27:59 +0000 (20:27 +0100)
commit53ad4a948a4586359b841d607c08fb16c5503230
tree0b7f436cecdc52f5f8b851239e793ebd06ff29ee
parentc0ae43d303e45764918fa8c1dc13d6a5db59c479
gpio: virtuser: fix UAF in configfs release path

The gpio-virtuser configfs release path uses guard(mutex) to protect
the device structure. However, the device is freed before the guard
cleanup runs, causing mutex_unlock() to operate on freed memory.

Specifically, gpio_virtuser_device_config_group_release() destroys
the mutex and frees the device while still inside the guard(mutex)
scope. When the function returns, the guard cleanup invokes
mutex_unlock(&dev->lock), resulting in a slab use-after-free.

Limit the mutex lifetime by using a scoped_guard() only around the
activation check, so that the lock is released before mutex_destroy()
and kfree() are called.

Fixes: 91581c4b3f29 ("gpio: virtuser: new virtual testing driver for the GPIO API")
Signed-off-by: Yuhao Huang <nekowong743@gmail.com>
Link: https://lore.kernel.org/r/20260126040348.11167-1-yuhaohuang@YuhaodeMacBook-Pro.local
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
drivers/gpio/gpio-virtuser.c