From nobody Fri Oct 2 02:30:24 2026 Received: from smtpbgbr1.qq.com (smtpbgbr1.qq.com [54.207.19.206]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD68E41F37A for ; Thu, 6 Aug 2026 08:49:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.207.19.206 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006194; cv=none; b=qfWeSWsjbVu+udp8sbvyzXA7CuYUnVM9QgBarzLp9xhjhQu+pP04To4xxhAZBZIuXMR3BY5pZWz76PpBo44ufUSV+RpqVMQ/tMkfNcPlgJXdogfH3dkgnIiFj1O6TubYEPyLvmCjJc/aZyM++NN2Zmt6phcLLXcfKG3KDo8BII8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006194; c=relaxed/simple; bh=ARu3eo+AzmCY/i1tQVvRQ0wec1DQQyp45sCuLGUpD9k=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=eIkpsIYawZS9sHGp6j8KGmOvxY3IFnShaFsc39DpkblPb8pgM0arne1bfVzATonw+No4Dgy8tgjzHjSz69tBfGXbV3gL7MzEYJ2h6Xkrm0efeXTY2p6idU/ZF8WBJ5JxhRDaxvSY+b63y0ng5Hs8i9pyc66OoIvB9oeZxHGQyJs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=UIgXAP4Z; arc=none smtp.client-ip=54.207.19.206 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="UIgXAP4Z" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786006149; bh=whvAXfqcI/2CG+KFaVGKysE7QcfBGYNfN6vsf1EJrf4=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=UIgXAP4ZZuNZi3YLaNO171bGHcX5h4lTy8Juci2etRv43J5Hj0Sakc6JAqURyfE6D pJ1dqDfgOsVtCNObJRQY5oA8GgJ21UvlStHKx4e3d4W4en0uQXvEUgfF6CEcrNeqwL 9I7fhicZFFW4LEICPHiMIP46FeH3/sPEe8Uyn3J4= X-QQ-mid: esmtpgz10t1786006143tdf8f9d1c X-QQ-Originating-IP: uf6iFDgW7rDy3zzGqYADMSBmyCO/dnFQ3AfidrBp4r0= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 06 Aug 2026 16:49:01 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 14852656375599871192 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v2 1/3] interconnect: debugfs: replace writable string helper Date: Thu, 6 Aug 2026 16:48:52 +0800 Message-Id: <20260806084854.1019789-2-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260806084854.1019789-1-chenyichong@uniontech.com> References: <20260806084854.1019789-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: MuYB7VmwJPrIoa/Yjtkby4LraX6dUTqAslqsYpI4MVLZRepyVfoohM5b 4W1XGBjvT+10YkLPzM8aSlvz1hYMSblHtYER8k2IZtWqkxmu3LAK9hgVXXu/HFgeXNKzGo+ 8bgs2CcYtEcOdsS0FHIPUkLghxqpb/eoVtt7NpTlTBrBGTTVEANM404EyvuWCyQi5qIikbd 1vpXx9aB6QcynlbrTgmj89BafuZpoPPc2j8Y+XrYscQNWeP2f+99wd/trkefkHCxMXqzqYJ l9VGtIMULXp5P8UY+hqiJx0TzvrvL0E7xMZ+DLKA+RXEILLmxkkC0XPpT/0nhinIpDE6jM0 fPT7+7e6VnXPtSGyebZZ2ZeycpJFoJNVAtSDDpnUXK77tS5YktjyKLL5JqmMgq5NotrAiJO gIbuwa4Drea5c28sIUuMy+mb+83gczVIm1UqlFNv/HhapFELU3rooNYxXCqC7hT5MTVQ2NN tGLkrwRSwEwYJ8DbXfHYazPJsONY21SDSzOEkbVxf+e7FLihfnwZ/B+MyHdrHDHKIYqbdeS tV166ivkx9FrDKc6uEAtURD2I4WDTTZPT4Si7dfHqDpeJf4xgcy1DAcR3Usgsw5AF10Ge13 0/h4O/ZiF3ZLMEs9UE+T3W9qxx+EQazG9hN8zhGF1i/bvvXYs1l8sTW06SGgJJs06U1PgxH 5e7ypsXvsUpuOdZZ6KVM1P34x7qnyRp3qGERu8geLJh0X4d1HJcXxMn81bV5iJtkBCLtQNO Jw6al3B/4RvR8Y7lKZ/bJg4Npr2AKRcini9baqPFJBNuUgArXFPGxHxI95dcfVXMWV541KD pZkTHGJr3HITusSlNs55it7+T8L02FqIslqhfZFBphDDuoN7qmyrr6h4Dln5D9vNaHSv7wW tiypG9X3RScQwLydRjepEBrYAshJcKg/BZMhgII6XwmfE093fsRKMSe6ghGrVJu636LO8fi 2WSTbEDw8+7+hxHrzYedJWV/061HnbeF6wszZWSycsqb7JwB/RVHuhHNWTIbDcRcJQQYj7N C7GEXZG5QWF/7/tNsdJVP1OOY6c7y2//Xdfd44uYuPjusQ0g5c X-QQ-XMRINFO: NS+P29fieYNwqS3WCnRCOn9D1NpZuCnCRA== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() is being made read-only because its generic write path is hard to make safe without adding more locking to the helper. Convert the interconnect debugfs client src_node and dst_node entries to local file operations before removing writable string support from debugfs_create_str(). Protect the string replacement and path lookup with the existing debugfs_lock. Signed-off-by: Yichong Chen --- drivers/interconnect/debugfs-client.c | 75 ++++++++++++++++++++++----- 1 file changed, 62 insertions(+), 13 deletions(-) diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/d= ebugfs-client.c index 08df9188ef94..b71c25fd9314 100644 --- a/drivers/interconnect/debugfs-client.c +++ b/drivers/interconnect/debugfs-client.c @@ -5,6 +5,7 @@ #include #include #include +#include =20 #include "internal.h" =20 @@ -36,6 +37,59 @@ struct debugfs_path { struct list_head list; }; =20 +static ssize_t icc_node_read(struct file *file, char __user *user_buf, + size_t count, loff_t *ppos) +{ + char **node =3D file->private_data; + char *copy; + size_t len; + ssize_t ret; + + mutex_lock(&debugfs_lock); + copy =3D kstrdup(*node ?: "", GFP_KERNEL); + mutex_unlock(&debugfs_lock); + if (!copy) + return -ENOMEM; + + len =3D strlen(copy); + copy[len++] =3D '\n'; + ret =3D simple_read_from_buffer(user_buf, count, ppos, copy, len); + kfree(copy); + return ret; +} + +static ssize_t icc_node_write(struct file *file, const char __user *user_b= uf, + size_t count, loff_t *ppos) +{ + char **node =3D file->private_data; + char *old, *new; + + if (*ppos) + return -EINVAL; + if (count + 1 > PAGE_SIZE) + return -E2BIG; + + new =3D memdup_user_nul(user_buf, count); + if (IS_ERR(new)) + return PTR_ERR(new); + strim(new); + + mutex_lock(&debugfs_lock); + old =3D *node; + *node =3D new; + mutex_unlock(&debugfs_lock); + + kfree(old); + return count; +} + +static const struct file_operations icc_node_fops =3D { + .open =3D simple_open, + .read =3D icc_node_read, + .write =3D icc_node_write, + .llseek =3D default_llseek, +}; + static struct icc_path *get_path(const char *src, const char *dst) { struct debugfs_path *path; @@ -56,24 +110,17 @@ static int icc_get_set(void *data, u64 val) =20 mutex_lock(&debugfs_lock); =20 - rcu_read_lock(); - src =3D rcu_dereference(src_node); - dst =3D rcu_dereference(dst_node); - /* * If we've already looked up a path, then use the existing one instead * of calling icc_get() again. This allows for updating previous BW * votes when "get" is written to multiple times for multiple paths. */ - cur_path =3D get_path(src, dst); - if (cur_path) { - rcu_read_unlock(); + cur_path =3D get_path(src_node, dst_node); + if (cur_path) goto out; - } =20 - src =3D kstrdup(src, GFP_ATOMIC); - dst =3D kstrdup(dst, GFP_ATOMIC); - rcu_read_unlock(); + src =3D kstrdup(src_node, GFP_KERNEL); + dst =3D kstrdup(dst_node, GFP_KERNEL); =20 if (!src || !dst) { ret =3D -ENOMEM; @@ -160,8 +207,10 @@ int icc_debugfs_client_init(struct dentry *icc_dir) =20 client_dir =3D debugfs_create_dir("test_client", icc_dir); =20 - debugfs_create_str("src_node", 0600, client_dir, &src_node); - debugfs_create_str("dst_node", 0600, client_dir, &dst_node); + debugfs_create_file("src_node", 0600, client_dir, &src_node, + &icc_node_fops); + debugfs_create_file("dst_node", 0600, client_dir, &dst_node, + &icc_node_fops); debugfs_create_file("get", 0200, client_dir, NULL, &icc_get_fops); debugfs_create_u32("avg_bw", 0600, client_dir, &avg_bw); debugfs_create_u32("peak_bw", 0600, client_dir, &peak_bw); --=20 2.51.0 From nobody Fri Oct 2 02:30:24 2026 Received: from smtpbgau1.qq.com (smtpbgau1.qq.com [54.206.16.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A742341F36F for ; Thu, 6 Aug 2026 08:49:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.206.16.166 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006195; cv=none; b=WTwgdoyxvuhB/8I8HxLVKY0/k/pfk4ouxP6ePZ7fhcR94oIiYYgYGhqsNNVHXCl2qGseOuweRXsUtlPqDVbuSpQzKnF5yksQuUEvnN7fQw6UDUVQNN92oOWY808mtkxKQfzEoObY5sbY2GxyJlUOgiPZotcA6cDbKWNsLKsIpe8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006195; c=relaxed/simple; bh=bYVn57snV5A2ibN/w2p93lM39rQLKNNKwdn5GeNSJKk=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=SLD8tQB97bVDmZJBCqBZs21eVhLtXM/QJfORhC65UHjBbfQaky3IxksiWk7FCT0ITt5n/ZtTi0YflV1jyutelam6HMUJoeNnGEtWJSPy3hE5XtrXZYvkTdt8Hci+qJ+SQOTUBE1R58CpN1YUQ83f7gZEkNXhnVfbIXB0g5v9prM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=TY2F0cFK; arc=none smtp.client-ip=54.206.16.166 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="TY2F0cFK" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786006154; bh=jUyYmBTsmqs0n3Z9OLd2hHj4Q6AzdFTzYfegDmaEhuU=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=TY2F0cFKeX61LRRhufNlwe6FQvycX2zlbQWxfwLrhR47N3DfJ/4NB5+CnKSKEgzca D6pDvJZIt9iLIjW0wYbMLLzsx6sxAlE7mBr9zp9xQjuPfwEI9lgGEJBypkTr7Nj0YU yWdzYZz97Vu8b8NDznF1aouwkS7Ld0q6TgS6+53M= X-QQ-mid: esmtpgz10t1786006148t22d80378 X-QQ-Originating-IP: D2JFE83FYkgCrQbhtgVWxiQGpFIeUpgu08ldEDCPt7U= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 06 Aug 2026 16:49:06 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 736460180246486777 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v2 2/3] soundwire: debugfs: replace writable string helper Date: Thu, 6 Aug 2026 16:48:53 +0800 Message-Id: <20260806084854.1019789-3-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260806084854.1019789-1-chenyichong@uniontech.com> References: <20260806084854.1019789-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: Mm/8i8/T4yneonnyiX7T3B4fEjZxZpO0mv8jmi4AE13nuEdSs9GAJldI 6QO/wG3SwO4i9LesVnr5pKWLhElxU2YiJG1C5vEvi6/J2oHMil6yiVQXbBawADcuwhEveS+ 8fMmXVNvKqSaVIMIsq3DQ9Xinp4998OLye/ae1jkjyUF3X/4Q8jOOgIxl6LiqiU3GgE1rEP xPL+C4sbhfUQtg240HmtmUmzUlLgQLQv7I/505D0xbp0L2B9pOrCto2rNau4XlkM7RppzAI KKuxq6B6sVAHAvTy3O0MaC/alvg2lZwKYKsEWyEhK1/QikIEYyiqdRX8/O2ZnVp+n7rUORs IGBGm2vjIqD1SoBUPgE2UMTQGWFxC1kR9x5CxB/v5OT6SQvPmN2TeUr47WUorT5wRa+EfQi OCb110gp1pkOPV2tbVlwJoL5BSrhhRxg0j0lundRZVAVRHB26G7KQcD0p0zNHeXJYDSUeUS gv8QuYogf1BFrRnDUeI246GoPT8DpQmnHTamAx9syl0NJJTVOJwGqrfPxQzZMEXN9NLA7up eL7+j24uF0YKpbFt2LkEZCjFVR2uZDZFWVDc9v6OjlG8T/fZRpDgg7sxYc5mdi51eJhAYi4 E5hIC8RsDa/p1otcPDAj8ajxI+nW9HnpnpBTPOilNuCaxJqdlvvIQDItmYDXSiHe0RxvKeY EF0WcwfbvqOUFvylvargqZLjU8H8JP25EGaPTJ3uDvrPYaeOyfDOwRE+MHPpqzq7nQSpa/J wIfbn1PcU36sHwHJ3CDBGgtgfpeQTGtXwlP+zMAX+OgzNsZAGP5Q1ugFdEWZcaMWSiWFsb7 7XUznynjTmE67V7NqZECGag4EA/k+DF3WKv0IxpuwQnvQ1hzdL9W61ZmnMR03H85kdAVsRt w6yDqizU/4G0Br2syz0sLcWYoU4Q/6swJbTslLDL//EzJ7Yl2etsQ624RmRIVS4OOA4M8Z0 uLjCInbFe5wAkHrFTo54diQsBI9rCmuCArhfBCQMg12M/V73ZbcZJtw/x79r1EKV64WDoGC R4PIw2sJvcHPilRUImqDc3G1Q67WE= X-QQ-XMRINFO: M/715EihBoGS47X28/vv4NpnfpeBLnr4Qg== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() is being made read-only because its generic write path is hard to make safe without adding more locking to the helper. Convert the SoundWire firmware_file entry to a local write-only file operation before removing writable string support from debugfs_create_str(). Copy the firmware name before request_firmware() so later debugfs writes cannot replace the string while it is being used. Signed-off-by: Yichong Chen --- drivers/soundwire/debugfs.c | 56 ++++++++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 4 deletions(-) diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c index 099eb84a548e..bba2b65a0668 100644 --- a/drivers/soundwire/debugfs.c +++ b/drivers/soundwire/debugfs.c @@ -145,6 +145,38 @@ static u32 start_addr; static size_t num_bytes; static u8 read_buffer[MAX_CMD_BYTES]; static char *firmware_file; +static DEFINE_MUTEX(firmware_file_lock); + +static ssize_t firmware_file_write(struct file *file, + const char __user *user_buf, + size_t count, loff_t *ppos) +{ + char *old, *new; + + if (*ppos) + return -EINVAL; + if (count + 1 > PAGE_SIZE) + return -E2BIG; + + new =3D memdup_user_nul(user_buf, count); + if (IS_ERR(new)) + return PTR_ERR(new); + strim(new); + + mutex_lock(&firmware_file_lock); + old =3D firmware_file; + firmware_file =3D new; + mutex_unlock(&firmware_file_lock); + + kfree(old); + return count; +} + +static const struct file_operations firmware_file_fops =3D { + .open =3D simple_open, + .write =3D firmware_file_write, + .llseek =3D default_llseek, +}; =20 static int set_command(void *data, u64 value) { @@ -246,6 +278,7 @@ static int cmd_go(void *data, u64 value) { const struct firmware *fw =3D NULL; struct sdw_slave *slave =3D data; + char *fw_name =3D NULL; ktime_t start_t; ktime_t finish_t; int ret; @@ -265,15 +298,24 @@ static int cmd_go(void *data, u64 value) } =20 if (cmd =3D=3D 0) { - ret =3D request_firmware(&fw, firmware_file, &slave->dev); + mutex_lock(&firmware_file_lock); + if (firmware_file) + fw_name =3D kstrdup(firmware_file, GFP_KERNEL); + mutex_unlock(&firmware_file_lock); + if (!fw_name) { + ret =3D -ENOMEM; + goto out; + } + + ret =3D request_firmware(&fw, fw_name, &slave->dev); if (ret < 0) { - dev_err(&slave->dev, "firmware %s not found\n", firmware_file); + dev_err(&slave->dev, "firmware %s not found\n", fw_name); goto out; } if (fw->size < num_bytes) { dev_err(&slave->dev, "firmware %s: firmware size %zd, desired %zd\n", - firmware_file, fw->size, num_bytes); + fw_name, fw->size, num_bytes); goto out; } } @@ -306,6 +348,7 @@ static int cmd_go(void *data, u64 value) out: if (fw) release_firmware(fw); + kfree(fw_name); =20 pm_runtime_mark_last_busy(&slave->dev); pm_runtime_put(&slave->dev); @@ -358,7 +401,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave) =20 debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops); if (firmware_file) - debugfs_create_str("firmware_file", 0200, d, &firmware_file); + debugfs_create_file("firmware_file", 0200, d, NULL, + &firmware_file_fops); =20 slave->debugfs =3D d; } @@ -370,8 +414,10 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave) =20 void sdw_debugfs_init(void) { + mutex_lock(&firmware_file_lock); if (!firmware_file) firmware_file =3D kstrdup("", GFP_KERNEL); + mutex_unlock(&firmware_file_lock); =20 sdw_debugfs_root =3D debugfs_create_dir("soundwire", NULL); } @@ -379,6 +425,8 @@ void sdw_debugfs_init(void) void sdw_debugfs_exit(void) { debugfs_remove_recursive(sdw_debugfs_root); + mutex_lock(&firmware_file_lock); kfree(firmware_file); firmware_file =3D NULL; + mutex_unlock(&firmware_file_lock); } --=20 2.51.0 From nobody Fri Oct 2 02:30:24 2026 Received: from smtpbgbr2.qq.com (smtpbgbr2.qq.com [54.207.22.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E88741F37A for ; Thu, 6 Aug 2026 08:49:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.207.22.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006200; cv=none; b=g2+N+7MNpY5ZstqRi4E/6DUreWyaQNxay9T3FdIF13oCXV7MIFhqwXSRP4uWntAgcQ2SH+c4UNFtthH+mh/+ZDIDLNFrC3EW/zPILGL5NIdfEEkIlh8IiCp0j5sRqpif4NW7FrzmZm0IzemBYwoPb4D4d5WS2P7UQqxBlN1GtVc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786006200; c=relaxed/simple; bh=ePp+RxiutBCyzzEvl5K1dmKuPb/y40CYrZgkRG5vNg0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=U7FpFoMGfm81J4805A5jwT4oiPWQm+U8Ccp/BE41bsuG16dW7n360dSMlNYyiBYhfUEtLfxdU/AfRuvWgxVM+vdJSutQQH/CqIr8fEr5NYJHmpI3BgoMmdFEkhYTvpYkgTrcMqXbPYp8EZuyMHCCjXFkZnkQYbzqwAwdfEJzdd8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=eBkq8aG5; arc=none smtp.client-ip=54.207.22.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="eBkq8aG5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786006158; bh=qvo8GnxR4HBw5KUhU+lgGsArbxbsBLDwyjUKHDJAdeY=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=eBkq8aG5AY9+sOScid5oBlapucgVKrgfbbUlj1FXeeXNJoIIEFq+XfLC1Sa6f3vIj jyDPRcaiJi/z3lF197cxIDP7RVztLNaUWUF3CONPCJiNmjMUaZtplfb/6GLyaY2QdI 4eQ83DjdBjyY0PCXrBNIcUrhwHuzHiP5EK7Bs92U= X-QQ-mid: esmtpgz10t1786006153t5a193209 X-QQ-Originating-IP: JVhbFHdaKldKfaSuDbI31KdscLgt26kiGyz/MsQ1sFk= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Thu, 06 Aug 2026 16:49:10 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 11587436272673348081 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v2 3/3] debugfs: make debugfs_create_str() read-only Date: Thu, 6 Aug 2026 16:48:54 +0800 Message-Id: <20260806084854.1019789-4-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260806084854.1019789-1-chenyichong@uniontech.com> References: <20260806084854.1019789-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: esmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: Mh1JMxfliF/1MGldjCRDRJRwJtAVKKQlCrJHxteiApDdMbhGrm5tquH/ Xv2XAbGoAvGCCXOWJHRwTVf/YfbF/FmeNzF5WC6Yr43wkBJUXlgR9/iUAK/uAtBeGQsWr9m wdGWkW0aq3DId0HWZvyWUeqhC1XdDugPtOsqSamTb7KjXlY1hMUCXWtSoJxss8eYTmuxdfq GsKdXDCVXmssOi84PBSKMkBHrN6/FwMUny0sKWt6nAYr5lDQV5A1wzxeqSZcqaFiMbDCNTz gwZfIf7qnIsH7NsQpUd/tdSjetbmHo5hZvsxvDnfijhsMBhz09H5IQw5DeurlRt45woT2l3 0qKBQxJXL510ZFk9OqvMW8qTTltzcPNKTVlZxJv9wPvRR8EjnVC4ImyyfWXRFxeq8ZvQDNK OxTIPptbGPzKBaObMMiAQJVAi8AQC/ori1i5raCkp+OFaX1P1+PyiIRfDnfb85Y2jUWJe73 tHOxPqoieiD0qCqPRVsIvYnYiiBbwaCTIe+SAMI0oRAX28Ong0K/LuaUTL8KYOLXpHWZNZA s+FQZseN0ZXVZdz93IlLKH0vUg8QmII6iUl7EvMeZruTtS4qpDZ0P2gCuqobCEztG61hpum vPg6Dv6LpTOPF7eCRULC0HU846i5tK6LlTnXpFHEiTs9WhBZqvfScb/i3/AUK5s/Eg10B2e 7l3uHbFuPs3WZqvelvKMf/UwoefKHQJYuhaV6MLvVT7si5jNVlTiC+HXWALSWjV8dPSEhdZ DXWeLqTmVhWkG/2VX+fErGB/EYo4rc4D/4ApKMsZ5Mz1dkHSl9bVR49xQC5UJzcu+MUGywq sh8XwyreqvfFDmAtEixuq2TXZg9HBLZ8VTTyN+bcLHh6dLPLkEP/N0r3NkqBC1w3cW35Bil y0ZYA1/O6zhuDAaBu6OquWo8YzfRJrn581IA1VOOfWfgAkVSTZSVQsnNmiGiBpKVO71ZrwE vxxSUItxROxg766dTOQJCJ9T9oIcGVcrFRbL034EyWmHz0CWvLIN0RzmUys5esdHAx4gp2l xL1Qrgwjgg4XPCnPzjfycGHMnXfPwM2b0sAZm6HRT0OBMgBU+r6hn/QS5dWWU= X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() supports replacing the backing string from userspace. Concurrent writers can race and free the same old string twice. All writable in-tree users have been converted to local file operations. Remove the generic write support from debugfs_create_str(), and refuse to create a file when the caller passes write permission bits. This makes unsupported writable use visible instead of silently creating a file with different permissions. Fixes: 86b5488121db ("debugfs: Add write support to debugfs_create_str()") Signed-off-by: Yichong Chen --- fs/debugfs/file.c | 81 ++++++----------------------------------------- 1 file changed, 10 insertions(+), 71 deletions(-) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index 08de6652a4f3..f5abd067b260 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -1049,98 +1049,37 @@ ssize_t debugfs_read_file_str(struct file *file, ch= ar __user *user_buf, return ret; } =20 -static ssize_t debugfs_write_file_str(struct file *file, const char __user= *user_buf, - size_t count, loff_t *ppos) -{ - struct dentry *dentry =3D F_DENTRY(file); - char *old, *new =3D NULL; - int pos =3D *ppos; - int r; - - r =3D debugfs_file_get(dentry); - if (unlikely(r)) - return r; - - old =3D *(char **)file->private_data; - - /* only allow strict concatenation */ - r =3D -EINVAL; - if (pos && pos !=3D strlen(old)) - goto error; - - r =3D -E2BIG; - if (pos + count + 1 > PAGE_SIZE) - goto error; - - r =3D -ENOMEM; - new =3D kmalloc(pos + count + 1, GFP_KERNEL); - if (!new) - goto error; - - if (pos) - memcpy(new, old, pos); - - r =3D -EFAULT; - if (copy_from_user(new + pos, user_buf, count)) - goto error; - - new[pos + count] =3D '\0'; - strim(new); - - rcu_assign_pointer(*(char __rcu **)file->private_data, new); - synchronize_rcu(); - kfree(old); - - debugfs_file_put(dentry); - return count; - -error: - kfree(new); - debugfs_file_put(dentry); - return r; -} - static const struct file_operations fops_str =3D { .read =3D debugfs_read_file_str, - .write =3D debugfs_write_file_str, - .open =3D simple_open, - .llseek =3D default_llseek, -}; - -static const struct file_operations fops_str_ro =3D { - .read =3D debugfs_read_file_str, - .open =3D simple_open, - .llseek =3D default_llseek, -}; - -static const struct file_operations fops_str_wo =3D { - .write =3D debugfs_write_file_str, .open =3D simple_open, .llseek =3D default_llseek, }; =20 /** - * debugfs_create_str - create a debugfs file that is used to read and wri= te a string value + * debugfs_create_str - create a debugfs file that is used to read a strin= g value * @name: a pointer to a string containing the name of the file to create. * @mode: the permission that the file should have * @parent: a pointer to the parent dentry for this file. This should be a * directory dentry if set. If this parameter is %NULL, then the * file will be created in the root of the debugfs filesystem. - * @value: a pointer to the variable that the file should read to and write - * from. This pointer and the string it points to must not be %NUL= L. + * @value: a pointer to the variable that the file should read from. This + * pointer and the string it points to must not be %NULL. * * This function creates a file in debugfs with the given name that - * contains the value of the variable @value. If the @mode variable is so - * set, it can be read from, and written to. + * contains the value of the variable @value. The file can be read from. + * Writable files are not supported; if @mode contains write permission bi= ts, + * no file is created. */ void debugfs_create_str(const char *name, umode_t mode, struct dentry *parent, char **value) { if (WARN_ON(!value || !*value)) return; + if (WARN_ONCE(mode & 0222, + "%s() does not support writable files\n", __func__)) + return; =20 - debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str, - &fops_str_ro, &fops_str_wo); + debugfs_create_file_unsafe(name, mode, parent, value, &fops_str); } EXPORT_SYMBOL_GPL(debugfs_create_str); =20 --=20 2.51.0