In the greybus audio_helper code, the debugfs file for the dapm has the
potential to be removed and memory will be leaked.  There is also the
very real potential for this code to remove ALL debugfs entries from the
system, and it seems like this is what will really happen if this code
ever runs.  This all is very wrong as the greybus audio driver did not
create this debugfs file, the sound core did and controls the lifespan
of it.

So remove all of the debugfs logic from the audio_helper code as there's
no way it could be correct.  If this really is needed, it can come back
with a fixup for the incorrect usage of the debugfs_lookup() call which
is what caused this to be noticed at all.

Cc: Johan Hovold <johan@kernel.org>
Cc: Alex Elder <elder@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: greybus-dev@lists.linaro.org
Cc: linux-staging@lists.linux.dev
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/greybus/audio_helper.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/drivers/staging/greybus/audio_helper.c b/drivers/staging/greybus/audio_helper.c
index 05e91e6bc2a0..223987616e07 100644
--- a/drivers/staging/greybus/audio_helper.c
+++ b/drivers/staging/greybus/audio_helper.c
@@ -3,7 +3,6 @@
  * Greybus Audio Sound SoC helper APIs
  */
 
-#include <linux/debugfs.h>
 #include <sound/core.h>
 #include <sound/soc.h>
 #include <sound/soc-dapm.h>
@@ -116,10 +115,6 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm,
 {
 	int i;
 	struct snd_soc_dapm_widget *w, *tmp_w;
-#ifdef CONFIG_DEBUG_FS
-	struct dentry *parent = dapm->debugfs_dapm;
-	struct dentry *debugfs_w = NULL;
-#endif
 
 	mutex_lock(&dapm->card->dapm_mutex);
 	for (i = 0; i < num; i++) {
@@ -139,12 +134,6 @@ int gbaudio_dapm_free_controls(struct snd_soc_dapm_context *dapm,
 			continue;
 		}
 		widget++;
-#ifdef CONFIG_DEBUG_FS
-		if (!parent)
-			debugfs_w = debugfs_lookup(w->name, parent);
-		debugfs_remove(debugfs_w);
-		debugfs_w = NULL;
-#endif
 		gbaudio_dapm_free_widget(w);
 	}
 	mutex_unlock(&dapm->card->dapm_mutex);
-- 
2.37.3

On Fri, Sep 02, 2022 at 04:37:15PM +0200, Greg Kroah-Hartman wrote:
> In the greybus audio_helper code, the debugfs file for the dapm has the
> potential to be removed and memory will be leaked.  There is also the
> very real potential for this code to remove ALL debugfs entries from the
> system, and it seems like this is what will really happen if this code
> ever runs.  This all is very wrong as the greybus audio driver did not
> create this debugfs file, the sound core did and controls the lifespan
> of it.

Yeah, this looks very broken indeed.

> So remove all of the debugfs logic from the audio_helper code as there's
> no way it could be correct.  If this really is needed, it can come back
> with a fixup for the incorrect usage of the debugfs_lookup() call which
> is what caused this to be noticed at all.

> Cc: Johan Hovold <johan@kernel.org>
> Cc: Alex Elder <elder@kernel.org>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: greybus-dev@lists.linaro.org
> Cc: linux-staging@lists.linux.dev
> Cc: stable <stable@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

I know this has already been applied, but still:

Acked-by: Johan Hovold <johan@kernel.org>

On Tue, Sep 13, 2022 at 03:06:49PM +0200, Johan Hovold wrote:
> On Fri, Sep 02, 2022 at 04:37:15PM +0200, Greg Kroah-Hartman wrote:
> > In the greybus audio_helper code, the debugfs file for the dapm has the
> > potential to be removed and memory will be leaked.  There is also the
> > very real potential for this code to remove ALL debugfs entries from the
> > system, and it seems like this is what will really happen if this code
> > ever runs.  This all is very wrong as the greybus audio driver did not
> > create this debugfs file, the sound core did and controls the lifespan
> > of it.
> 
> Yeah, this looks very broken indeed.
> 
> > So remove all of the debugfs logic from the audio_helper code as there's
> > no way it could be correct.  If this really is needed, it can come back
> > with a fixup for the incorrect usage of the debugfs_lookup() call which
> > is what caused this to be noticed at all.
> 
> > Cc: Johan Hovold <johan@kernel.org>
> > Cc: Alex Elder <elder@kernel.org>
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: greybus-dev@lists.linaro.org
> > Cc: linux-staging@lists.linux.dev
> > Cc: stable <stable@kernel.org>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> I know this has already been applied, but still:
> 
> Acked-by: Johan Hovold <johan@kernel.org>

Thanks for the review, much appreciated.

greg k-h