From nobody Wed Sep 30 13:54:33 2026 Received: from smtpbgbr1.qq.com (smtpbgbr1.qq.com [54.207.19.206]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC5123EDAC1 for ; Fri, 7 Aug 2026 10:03:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.207.19.206 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786096986; cv=none; b=f+Lifp5FWkppjqVnJAYzWF/qYYk/D7t7YTWMVp8Uh0sDPNp2sQ97EpvDX5OFJK06A1DsjJrWL/NGDDUcZETEZuFM64+jC+bhXcd9aVI3VpFfzZ9+XF9QrH1OIVchMgooKj0yxtENckHmSGc61r/d22heGuGTVIy0WVVbeyQZ1gA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786096986; c=relaxed/simple; bh=uPOW7rdVMm6V8ePe7kqGvb3eoPcsx/SPyrtcxzDrszY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=PN7CYs52s+e5Ymp9FOKyGxjnA0bx55L13jStHA96D36YFaMogEtILZK17VaYHQWoKAao34wxWXOyC5ly/H0PxzDABhOq90PE+RTTRhW7YZlg6oKjapOB5kNsLueM1mubomtmCGQb6BX+IuG0TD7wJUaPZzBytn8PRwkVOsytlAE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=Sf4nNkbv; arc=none smtp.client-ip=54.207.19.206 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="Sf4nNkbv" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786096934; bh=6oSMObSXCJFlZ+zBraZAJWfjfuycNvVXrH6aJjGCFLs=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=Sf4nNkbvV1mipNlwyxDKNnJM7pBmxJ/L8CIuMC1odi/pv4vPMsRFqu/b5MsD7JcQr 9qaeiOwlvkwzLp+anZq8qQBZDAkKQuyhkfzTPJH3i7cVFHM9XPa8Xwp7kMGPqaj2sP vIrK7ZHf2sMSLqZLVj8QWac6mOX9YGhN6vXcAhtA= X-QQ-mid: zesmtpgz1t1786096928t856e439f X-QQ-Originating-IP: fyo/Oo8PE3ZjJTPluJGSxT9G72pGfqCeKSGEeMqGfkk= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Fri, 07 Aug 2026 18:02:04 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 14027790777046860935 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v3 1/3] interconnect: debugfs: replace writable string helper Date: Fri, 7 Aug 2026 18:00:51 +0800 Message-Id: <20260807100053.1089834-2-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260807100053.1089834-1-chenyichong@uniontech.com> References: <20260807100053.1089834-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: MclpzN0hYnUEmPg4jVhE1yWg6dCP6yzeW0wykpYTZyFM2toiQetxXLbY qdc2FGY2Ug2FF2Tt7dXzqy1NMxQYjAjL9+nDUfYvwuyn1Vlu0OYQ0OU3WHBdxHiOlBEbCAD JFcPosqiM44rHwRPgQ8qpRRFvo9B5YmnyyguXRgIyCqI1OL3BDH36TXVpJ92HsfNrT6XmpW mejYi5KD8QCTrEmaANakm9wi7K2YvXBHx8JX0FH6ZipnQXJN7k4Sjxw+RfywT+ohYwTFaKV c0dnJYXT11GasZT8Pu3c03VaWyjwHLGgKONXSleLx4UmeSoRHwk6D0l3Gx26JueAlafcoHr 3hRjhQtio4u1iNzI0+Y6LQGZRE9L5AFmaetSTx2X8VMTSElF4Kw9tlEt6ptXiGYfice5Wqh v6ca9G9YlwtvFu23Q2hqWc/jlgNekp+8ZWrMGXB0TCKBWC3Ay1ViUwG2TyJv1bvJmfMas0Y FCU+UU+lAfBYMR86DUt8X2PHOmy9FHKe8iXUMYIZyLhqkeHBXKnWX+576icedrnTF1ugb0R eyqu9Au4PlFdmKw7wpeP+TC/bgXhNOmvjg07uL6efVpkdHVk1Ki1DFUSA3PBFwSg1jaqS8r FEojRmVD3ePBA7U8IR801213MfCEnRFC3lTGdoE59DzuWbRbusPvnzTlI8YinQN0D4bJmV4 Pi/icz8pjB1jRqtqd4jtWcczTATVRvamCSGJvaChnXVkYWq+w6Zofa+urW+7sdXNgY/a53e waSsWxYrdQ/HI6GiX5bFLSkIqjVsRX07F+b9GQiuIRL3+QSmWQvAMNHd9HLfw4+iUdHhmAU fNo14uhXBtKXOfs6UMWnA8F6IjVZOgWuJaAOyDYaIjM9m3OSGmK71qtNNgx9cfUdIDONFNp FhOhikDN26s1QVR8q9TYoZcQvahQhdEKcbvRUWRklzaFCUlwPq1Ica0AeEjDqZJ9Wi8hOni of0HW7Xr+yPeyqyPc03kDrSSGBerib98CG6IC9YzV4AhiR2cpGsIdWX/M0aHvpioJv9iogM 441CLGhev1meMv1V2ISv7PIKPlh9nCFaJpe6NcxhkXQ6xfJMyUJKb3FRum+zdvuQ0drHlvT vI1P+Zmg9IUvcq3tjwa75KrXmeTZOUwoOSiEmuX4NZBAFqncUnIzp6aYN/YoXarf3B8TciC 7Yts X-QQ-XMRINFO: OD9hHCdaPRBwH5bRRRw8tsiH4UAatJqXfg== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() is being made read-only because its generic write path is hard to make safe without adding more locking to the helper. Convert the interconnect debugfs client src_node and dst_node entries to local file operations before removing writable string support from debugfs_create_str(). Protect the string replacement and path lookup with the existing debugfs_lock. The old code duplicated the strings under rcu_read_lock(), so it had to use GFP_ATOMIC. The local file operations protect src_node and dst_node with debugfs_lock instead, so the allocation can use GFP_KERNEL. Signed-off-by: Yichong Chen --- drivers/interconnect/debugfs-client.c | 81 +++++++++++++++++++++------ 1 file changed, 64 insertions(+), 17 deletions(-) diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/d= ebugfs-client.c index 08df9188ef94..c587fbf519c6 100644 --- a/drivers/interconnect/debugfs-client.c +++ b/drivers/interconnect/debugfs-client.c @@ -5,6 +5,7 @@ #include #include #include +#include =20 #include "internal.h" =20 @@ -36,6 +37,59 @@ struct debugfs_path { struct list_head list; }; =20 +static ssize_t icc_node_read(struct file *file, char __user *user_buf, + size_t count, loff_t *ppos) +{ + char **node =3D file->private_data; + char *copy; + size_t len; + ssize_t ret; + + scoped_guard(mutex, &debugfs_lock) { + copy =3D kstrdup(*node ?: "", GFP_KERNEL); + } + if (!copy) + return -ENOMEM; + + len =3D strlen(copy); + copy[len++] =3D '\n'; + ret =3D simple_read_from_buffer(user_buf, count, ppos, copy, len); + kfree(copy); + return ret; +} + +static ssize_t icc_node_write(struct file *file, const char __user *user_b= uf, + size_t count, loff_t *ppos) +{ + char **node =3D file->private_data; + char *old, *new; + + if (*ppos) + return -EINVAL; + if (count + 1 > PAGE_SIZE) + return -E2BIG; + + new =3D memdup_user_nul(user_buf, count); + if (IS_ERR(new)) + return PTR_ERR(new); + strim(new); + + scoped_guard(mutex, &debugfs_lock) { + old =3D *node; + *node =3D new; + } + + kfree(old); + return count; +} + +static const struct file_operations icc_node_fops =3D { + .open =3D simple_open, + .read =3D icc_node_read, + .write =3D icc_node_write, + .llseek =3D default_llseek, +}; + static struct icc_path *get_path(const char *src, const char *dst) { struct debugfs_path *path; @@ -54,26 +108,19 @@ static int icc_get_set(void *data, u64 val) char *src, *dst; int ret =3D 0; =20 - mutex_lock(&debugfs_lock); - - rcu_read_lock(); - src =3D rcu_dereference(src_node); - dst =3D rcu_dereference(dst_node); + guard(mutex)(&debugfs_lock); =20 /* * If we've already looked up a path, then use the existing one instead * of calling icc_get() again. This allows for updating previous BW * votes when "get" is written to multiple times for multiple paths. */ - cur_path =3D get_path(src, dst); - if (cur_path) { - rcu_read_unlock(); + cur_path =3D get_path(src_node, dst_node); + if (cur_path) goto out; - } =20 - src =3D kstrdup(src, GFP_ATOMIC); - dst =3D kstrdup(dst, GFP_ATOMIC); - rcu_read_unlock(); + src =3D kstrdup(src_node, GFP_KERNEL); + dst =3D kstrdup(dst_node, GFP_KERNEL); =20 if (!src || !dst) { ret =3D -ENOMEM; @@ -105,7 +152,6 @@ static int icc_get_set(void *data, u64 val) kfree(src); kfree(dst); out: - mutex_unlock(&debugfs_lock); return ret; } =20 @@ -115,7 +161,7 @@ static int icc_commit_set(void *data, u64 val) { int ret; =20 - mutex_lock(&debugfs_lock); + guard(mutex)(&debugfs_lock); =20 if (!cur_path) { ret =3D -EINVAL; @@ -130,7 +176,6 @@ static int icc_commit_set(void *data, u64 val) icc_set_tag(cur_path, tag); ret =3D icc_set_bw(cur_path, avg_bw, peak_bw); out: - mutex_unlock(&debugfs_lock); return ret; } =20 @@ -160,8 +205,10 @@ int icc_debugfs_client_init(struct dentry *icc_dir) =20 client_dir =3D debugfs_create_dir("test_client", icc_dir); =20 - debugfs_create_str("src_node", 0600, client_dir, &src_node); - debugfs_create_str("dst_node", 0600, client_dir, &dst_node); + debugfs_create_file("src_node", 0600, client_dir, &src_node, + &icc_node_fops); + debugfs_create_file("dst_node", 0600, client_dir, &dst_node, + &icc_node_fops); debugfs_create_file("get", 0200, client_dir, NULL, &icc_get_fops); debugfs_create_u32("avg_bw", 0600, client_dir, &avg_bw); debugfs_create_u32("peak_bw", 0600, client_dir, &peak_bw); --=20 2.51.0 From nobody Wed Sep 30 13:54:33 2026 Received: from smtpbgsg2.qq.com (smtpbgsg2.qq.com [54.254.200.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2945B3FA5DD for ; Fri, 7 Aug 2026 10:03:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.254.200.128 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786096998; cv=none; b=jdM1mMEiVCqtAKt/Yw3hyGeLP6lwFG9uZWWNiT5lLZt4nuX33Gikf734ouIgwfPsHGsp57SKxIfirXXTDBzdD+JiqdOS3Gf1yntqOBNlItclvrrbgoWrEf+tgRB2ioYmSNwKqI1PAb3rDTTBxQZiqEHrIJuFvjL7V1GeGrzhk+A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786096998; c=relaxed/simple; bh=sTB+q2yGXMUFFVb/puERdZJCmbQ4/NCEbjGWkoO3doQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=EbLseGCy6BzMwrOSTbneR6tF4CZWFWI9Kmw4jpI1D8EZW1vrugjPWp837Egz1TyBkUYownWQlZfTE8aFqyQEXxA7lo8ObQ2ldlXVY7jAEE/lWD1rjW7xZ2SO+LJOKci2lrn79EglgPxPCArrM/AduXSPIdDIrF9P4+YYZmEm6Ks= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=RT68QvRk; arc=none smtp.client-ip=54.254.200.128 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="RT68QvRk" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786096943; bh=MsDLrJziY9sfCbxEdR4Mn3VYin9jFIv1p9TVwvNq7cs=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=RT68QvRkmS6GFP8VPC9D7ibZzoyK8U6EMDrk4mRWVnOU+SxSGPsaRkZCr8Ht4mNVR 0yv/qgsG4JiDW+w1UtEvqgupnbLa07BPfx5tasB4rCYVfzHymaoa7FB/4FKOc9egX4 9yg+TVLrcLTEQJodUGWy1KwgTa04OzKYBquifvgY= X-QQ-mid: zesmtpgz1t1786096938ta3e5e1b1 X-QQ-Originating-IP: S+p1emIyL/pTOuj2FrBZ+LochIXhVzo8lbfR6Q1S5xI= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Fri, 07 Aug 2026 18:02:11 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 17825993322717190689 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v3 2/3] soundwire: debugfs: replace writable string helper Date: Fri, 7 Aug 2026 18:00:52 +0800 Message-Id: <20260807100053.1089834-3-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260807100053.1089834-1-chenyichong@uniontech.com> References: <20260807100053.1089834-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: OA2DBih+LDLYVK7oeHVVfRU49+8yVsgq6Nc882r/c02Lqha8hJ0CwQxt k8WdY7b822R56V+KuquFFDoQO4YpzeT7Sx5nJmkCr/wbix6eU3p0j3yk+MfQk7GFSPKwegR VELqTXf5hfcCRn38KhHILMwDOhwilPx4n33Fj+vyFiFmxbMESIFtaGakY+FcigCge5bg15E d5oIbvcmQE9O1yCdBo68RPc876j0p54uXPlMMVNhikuMJLfQIomZBP4WoDLJhTP9pua41x5 FQePKfRmz67sK33Xwq+UBY2BnyGwqH4+GxCc1vYIvnXpoaegJrpR8tQIW1KUBvLvrADnZ0/ PGLVcRZuKpeLYpUp6dTVkfLaMyOTmBCD9KeSRzTUqOaybnEgqizSxS85arF3K2fDlEffDIz myD7/ea95EdYFA0p2ynNlvIzZsFRaKinWN6Jta0pvwU8CBHUNTmNdxSZ4f7mpCmC/hLdwDM zKAouLW1uijtvaz5dfthuLLuY/cMpgkQyshdBKm5lN6cp83oMXAaoQXZhPvj9EeWtvJ/LPh 50fDHTMadoyXP8+IS/n5uAp/WDe0ljUtH2oCbeC3r1E7Xel491Gnk2zVqJbIOIxRsNpvfmX WqyAaEY8NESPahvQiBA+66Xxl+m4L7fb6Peco0qNfGSbz2YvQAve/NEioh9lj2qfcnojo7b Xts4dETBfidSwh0QWUOALTO29qzciV0HJO//fcGQXQ17blYIQ6yiNRmQJWqJVPgAYU5SgUM t6GEsM8c8pMPpeKkQE9IRyzVM1ysi/zU7WtXvKFhu090UCnAzDNnK1fNLepfXaU+fum7bIo cf8cj/Dxn68J1zB+DSgMtUp+G8P3/sYRSFR5tpcYWLu4bxB4JoxdlnJYuoWQaBDX8WiZJW3 TVQZ/U+7ZNo0niVweBOiTJ5krNxoQhz+vrzgsQ5iz+ZHdzJw2RenjHCfffxvhVlTFO15WYd V2rivyZZzIG5HmBRHAE972U4QhBnaTzR1G9g7PyzNYioLb5v+rVq3ZDBvb4vsxWQnXrD1OQ w7xOxLb8rRMrk+P52NeBM8+5D8iaNo8oYlsGM2su9dGZvE1EKVIhLD9YUOd3igfGbPVXcyv XaLGZ0UX9TKlAJ5b+VS4+CqEX/DIaVL7yK3ILeuUz18nIpRwFRpa8TGcFLnwaITC8I07XFy EYjk X-QQ-XMRINFO: MPJ6Tf5t3I/ylTmHUqvI8+Wpn+Gzalws3A== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() is being made read-only because its generic write path is hard to make safe without adding more locking to the helper. Convert the SoundWire firmware_file entry to a local write-only file operation before removing writable string support from debugfs_create_str(). Copy the firmware name before request_firmware() so later debugfs writes cannot replace the string while it is being used. Signed-off-by: Yichong Chen --- drivers/soundwire/debugfs.c | 63 ++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 8 deletions(-) diff --git a/drivers/soundwire/debugfs.c b/drivers/soundwire/debugfs.c index 099eb84a548e..a8a6db164fe7 100644 --- a/drivers/soundwire/debugfs.c +++ b/drivers/soundwire/debugfs.c @@ -145,6 +145,38 @@ static u32 start_addr; static size_t num_bytes; static u8 read_buffer[MAX_CMD_BYTES]; static char *firmware_file; +static DEFINE_MUTEX(firmware_file_lock); + +static ssize_t firmware_file_write(struct file *file, + const char __user *user_buf, + size_t count, loff_t *ppos) +{ + char *old, *new; + + if (*ppos) + return -EINVAL; + if (count + 1 > PAGE_SIZE) + return -E2BIG; + + new =3D memdup_user_nul(user_buf, count); + if (IS_ERR(new)) + return PTR_ERR(new); + strim(new); + + scoped_guard(mutex, &firmware_file_lock) { + old =3D firmware_file; + firmware_file =3D new; + } + + kfree(old); + return count; +} + +static const struct file_operations firmware_file_fops =3D { + .open =3D simple_open, + .write =3D firmware_file_write, + .llseek =3D default_llseek, +}; =20 static int set_command(void *data, u64 value) { @@ -246,6 +278,7 @@ static int cmd_go(void *data, u64 value) { const struct firmware *fw =3D NULL; struct sdw_slave *slave =3D data; + char *fw_name =3D NULL; ktime_t start_t; ktime_t finish_t; int ret; @@ -265,15 +298,24 @@ static int cmd_go(void *data, u64 value) } =20 if (cmd =3D=3D 0) { - ret =3D request_firmware(&fw, firmware_file, &slave->dev); + scoped_guard(mutex, &firmware_file_lock) { + if (firmware_file) + fw_name =3D kstrdup(firmware_file, GFP_KERNEL); + } + if (!fw_name) { + ret =3D -ENOMEM; + goto out; + } + + ret =3D request_firmware(&fw, fw_name, &slave->dev); if (ret < 0) { - dev_err(&slave->dev, "firmware %s not found\n", firmware_file); + dev_err(&slave->dev, "firmware %s not found\n", fw_name); goto out; } if (fw->size < num_bytes) { dev_err(&slave->dev, "firmware %s: firmware size %zd, desired %zd\n", - firmware_file, fw->size, num_bytes); + fw_name, fw->size, num_bytes); goto out; } } @@ -306,6 +348,7 @@ static int cmd_go(void *data, u64 value) out: if (fw) release_firmware(fw); + kfree(fw_name); =20 pm_runtime_mark_last_busy(&slave->dev); pm_runtime_put(&slave->dev); @@ -358,7 +401,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave) =20 debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops); if (firmware_file) - debugfs_create_str("firmware_file", 0200, d, &firmware_file); + debugfs_create_file("firmware_file", 0200, d, NULL, + &firmware_file_fops); =20 slave->debugfs =3D d; } @@ -370,8 +414,10 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave) =20 void sdw_debugfs_init(void) { - if (!firmware_file) - firmware_file =3D kstrdup("", GFP_KERNEL); + scoped_guard(mutex, &firmware_file_lock) { + if (!firmware_file) + firmware_file =3D kstrdup("", GFP_KERNEL); + } =20 sdw_debugfs_root =3D debugfs_create_dir("soundwire", NULL); } @@ -379,6 +425,7 @@ void sdw_debugfs_init(void) void sdw_debugfs_exit(void) { debugfs_remove_recursive(sdw_debugfs_root); - kfree(firmware_file); - firmware_file =3D NULL; + scoped_guard(mutex, &firmware_file_lock) { + kfree(firmware_file); + } } --=20 2.51.0 From nobody Wed Sep 30 13:54:33 2026 Received: from smtpbgeu2.qq.com (smtpbgeu2.qq.com [18.194.254.142]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F12C40A942 for ; Fri, 7 Aug 2026 10:03:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.194.254.142 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786097004; cv=none; b=VzR/HNQGRDk9GXkjKI2RsSFyPdqbipj6w7FrRdj2kQZ3NtvOFNrCwK5XPB0hlNKX0Pi48slapWCn1bRnt0Thh2ynnlHxH5Jo9PMUOzKsIG5H7waV+bb42H+AgHmho6VcJu5Wr5dRP/S7S+Ql7v1GBQ4tAezKxXfdV5hh9r/t3aw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786097004; c=relaxed/simple; bh=HzKxMRWqgnUrqGjs5xW5rIPpkTGLbuRLIuuAwL4P/BQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=kSSH8VvZaIV5ZmgyDc5vrVtwo5C1Y/kpGO1ORHnuSB1VBDkGilExXvM+tmF3TA2F65dPf1ysdClmKLMPgg/Nxv2hU6afMETTfUpsilPc4eVzrwGBb9LHeEicH1yKOJmeTapOZrFzVb2vOFKQo/jJ8QzA/iiMv1L4E/OkcAR/X48= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com; spf=pass smtp.mailfrom=uniontech.com; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b=Pr1lB9gH; arc=none smtp.client-ip=18.194.254.142 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=uniontech.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=uniontech.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=uniontech.com header.i=@uniontech.com header.b="Pr1lB9gH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=uniontech.com; s=onoh2408; t=1786096949; bh=tP6FsQWEwYoq2MGkNGhgwZkP1Jh1LVRNF/KcW4T3hFY=; h=From:To:Subject:Date:Message-Id:MIME-Version; b=Pr1lB9gHZO1pq0I/ZRv3RgGmw01vSr6l0zMXXKDds7/pCV2cgVyJqc6nCPTdQbbTc Pr9iRCppgp8ax1RdqRiGIipYKmqaj64YdcwjbI5NZMIYgvvQEip6DalEXDkBR6rHUq esuL/GSIPFbccY6c4RdTkpW21wjsXzaNt8jyVFh0= X-QQ-mid: zesmtpgz1t1786096944tba2b5ced X-QQ-Originating-IP: 2ULuDb63Nqk5vrbJn0taO1cZCs7QEGJCr1/P5AoBP6M= Received: from uniontech.com ( [113.57.152.160]) by bizesmtp.qq.com (ESMTP) with id ; Fri, 07 Aug 2026 18:02:21 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 1 X-BIZMAIL-ID: 4948339811663763525 EX-QQ-RecipientCnt: 13 From: Yichong Chen To: gregkh@linuxfoundation.org Cc: rafael@kernel.org, dakr@kernel.org, djakov@kernel.org, quic_mdtipton@quicinc.com, vkoul@kernel.org, yung-chuan.liao@linux.intel.com, pierre-louis.bossart@linux.dev, driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, linux-pm@vger.kernel.org, linux-sound@vger.kernel.org, Yichong Chen Subject: [PATCH v3 3/3] debugfs: make debugfs_create_str() read-only Date: Fri, 7 Aug 2026 18:00:53 +0800 Message-Id: <20260807100053.1089834-4-chenyichong@uniontech.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20260807100053.1089834-1-chenyichong@uniontech.com> References: <20260807100053.1089834-1-chenyichong@uniontech.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpgz:uniontech.com:qybglogicsvrgz:qybglogicsvrgz3a-0 X-QQ-XMAILINFO: Nw5WZPeltq7pgynYcw2gXeji0DgY525l1Y3Q7QCQKOfpgTWPLWv9Zu08 eODgpEWCZKZeB1N2IcOrKNdKFQJE+a1/OMgSd/CYP1/zlERzzyiI+37vJElqiXejkF3RCLa yHgBJIBDw6NYEnrX8TBLNEsl7P75YC3rki0VqnGAvUwLCnIODjhk+iUrUbUB2QNTGyJk1cC jjABqQeQHsKJsU3TqHVL0XNw2WnacpIYGdAEZUTWQTO2XTUjNcfB99A9lKT0QGgWf4MmbM0 UUSploc6y1YHZtr9q3geAOj8mRqhnOa5APDG/iYcfO4peYtOc2/B00nvcdGgHiwAHGDClmq bhKaFqyxWamt1qZD0gW+/VuoWx+Lx8E3K2K2SdJMXkrCRqcaxJAFNNF2CMQFuQfCv0u2uHf 5zjkceY7GwirWnQSWTDM5nVVqa3r0RlkTXyHd0IrIudVIPLU+RI2rGfirrUQsRevxAA/1Pv Y9+SDuFYLI4rjUMuVedR9xDy75E21vrHxUi2JxjEXYYUCbSGFGwfGs1FC9BzcNlrhGZ0xMR nf0xFAwR8oM+UwEJFciV7HlfY7m4+WpASKLe9UyLAC35HrRo6gRi0w/BsL0ZQHUULKLrzgl bmpauaGvD5fTxfLkgX85n1/D2ihw5+YV1HTvXSinf9KX7gZ3/g6lnzOGraKArcENmKpNiGh lSbpFhj1XmPAjyylE/zbj77ZYLNjHWNhZeOGukItkqQBIXz49dPpNa9O0Ee4FMxxuZJZH8m 5WVdAmGqhgfl7eJrv3tv8X60cDtiKv/yziOWHIcwaAUVqFQafZRr8KS3jVYdf7OrEABPnCs y16U77dysam/a5vQSP3sxza5dIb8eHapFzLwQ01wn0ZUJQabmjrdri053oIA4DdL+miq/nM PpsBw14WC5ZBC/SreoMiKsrcyixELZhI2mLDrcN9KDfWC4y39qdhGOlZzffGVGJ42UZKiwt QFzXEobM7nBCqaB/iH9j/RPQf0XGlsVdV34n5pTvqRxTgExeqq3Kr7t4Sg0Ilr9ixGUQ9nl KowpoxRI/bxc3tj1cd99AasGTtWzWPoZa0m8nw/5gAVPHD85A80lEOSvAD637iEUkO12QzO 4tOCiFIIvyx/nZ9KF2I7Q7eViTdH1qFfBnylPA4C8VviADp/XIYn0+k9jiKra6BqU+UPcvq h8vpkhE13iqdAOg= X-QQ-XMRINFO: Mp0Kj//9VHAxzExpfF+O8yhSrljjwrznVg== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" debugfs_create_str() supports replacing the backing string from userspace. Concurrent writers can race and free the same old string twice. All writable in-tree users have been converted to local file operations. Remove the generic write support from debugfs_create_str(), and refuse to create a file when the caller passes write permission bits. This makes unsupported writable use visible instead of silently creating a file with different permissions. Fixes: 86b5488121db ("debugfs: Add write support to debugfs_create_str()") Signed-off-by: Yichong Chen --- fs/debugfs/file.c | 81 ++++++----------------------------------------- 1 file changed, 10 insertions(+), 71 deletions(-) diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c index 08de6652a4f3..170feb75317f 100644 --- a/fs/debugfs/file.c +++ b/fs/debugfs/file.c @@ -1049,98 +1049,37 @@ ssize_t debugfs_read_file_str(struct file *file, ch= ar __user *user_buf, return ret; } =20 -static ssize_t debugfs_write_file_str(struct file *file, const char __user= *user_buf, - size_t count, loff_t *ppos) -{ - struct dentry *dentry =3D F_DENTRY(file); - char *old, *new =3D NULL; - int pos =3D *ppos; - int r; - - r =3D debugfs_file_get(dentry); - if (unlikely(r)) - return r; - - old =3D *(char **)file->private_data; - - /* only allow strict concatenation */ - r =3D -EINVAL; - if (pos && pos !=3D strlen(old)) - goto error; - - r =3D -E2BIG; - if (pos + count + 1 > PAGE_SIZE) - goto error; - - r =3D -ENOMEM; - new =3D kmalloc(pos + count + 1, GFP_KERNEL); - if (!new) - goto error; - - if (pos) - memcpy(new, old, pos); - - r =3D -EFAULT; - if (copy_from_user(new + pos, user_buf, count)) - goto error; - - new[pos + count] =3D '\0'; - strim(new); - - rcu_assign_pointer(*(char __rcu **)file->private_data, new); - synchronize_rcu(); - kfree(old); - - debugfs_file_put(dentry); - return count; - -error: - kfree(new); - debugfs_file_put(dentry); - return r; -} - static const struct file_operations fops_str =3D { .read =3D debugfs_read_file_str, - .write =3D debugfs_write_file_str, - .open =3D simple_open, - .llseek =3D default_llseek, -}; - -static const struct file_operations fops_str_ro =3D { - .read =3D debugfs_read_file_str, - .open =3D simple_open, - .llseek =3D default_llseek, -}; - -static const struct file_operations fops_str_wo =3D { - .write =3D debugfs_write_file_str, .open =3D simple_open, .llseek =3D default_llseek, }; =20 /** - * debugfs_create_str - create a debugfs file that is used to read and wri= te a string value + * debugfs_create_str - create a debugfs file that is used to read a strin= g value * @name: a pointer to a string containing the name of the file to create. * @mode: the permission that the file should have * @parent: a pointer to the parent dentry for this file. This should be a * directory dentry if set. If this parameter is %NULL, then the * file will be created in the root of the debugfs filesystem. - * @value: a pointer to the variable that the file should read to and write - * from. This pointer and the string it points to must not be %NUL= L. + * @value: a pointer to the variable that the file should read from. This + * pointer and the string it points to must not be %NULL. * * This function creates a file in debugfs with the given name that - * contains the value of the variable @value. If the @mode variable is so - * set, it can be read from, and written to. + * contains the value of the variable @value. The file can be read from. + * Writable files are not supported; if @mode contains write permission bi= ts, + * no file is created. */ void debugfs_create_str(const char *name, umode_t mode, struct dentry *parent, char **value) { if (WARN_ON(!value || !*value)) return; + if (WARN(mode & 0222, + "%s() does not support writable files\n", __func__)) + return; =20 - debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str, - &fops_str_ro, &fops_str_wo); + debugfs_create_file_unsafe(name, mode, parent, value, &fops_str); } EXPORT_SYMBOL_GPL(debugfs_create_str); =20 --=20 2.51.0