Re: [TECH TOPIC] Revocable: a mechanism for preventing "classic" use-after-free bugs

[Linus Walleij <linus.walleij@linaro.org>]

On Sat, Sep 13, 2025 at 4:49 PM Tzung-Bi Shih <tzungbi@kernel.org> wrote:

> We will present "revocable"[2], a new kernel mechanism for resource
> management.  A revocable allows a resource provider (e.g., a device driver)
> to invalidate access to a resource from a consumer (e.g., a character device)
> when the underlying device is no longer available.  Once a resource is
> revoked, any further attempts to use it will fail gracefully, thus preventing
> the UAF.

I looked at it and it looks very interesting.

We have faced this problem in the GPIO subsystem because a lot
of GPIO expanders are on pluggable buses such as USB, while
there may still be consumers not only in kernelspace but also
in userspace.

We remove the underlying device driver and irqchip etc in
gpiochip_remove() with:

        /* Numb the device, cancelling all outstanding operations */
        rcu_assign_pointer(gdev->chip, NULL);

but any userspace consumers are
"dangling", which in practice means that e.g.
linehandle_ioctl() gets called and then:

        if (!rcu_access_pointer(lh->gdev->chip))
                return -ENODEV;

This seems to be using a similar idea or the same idea and using
RCU as well because you have:

void *revocable_try_access(struct revocable *rev) __acquires(&rev->rp->srcu)
{
    struct revocable_provider *rp = rev->rp;

    rev->idx = srcu_read_lock(&rp->srcu);
    return rcu_dereference(rp->res);
}

AFAICT this is pretty much the same, but more bells and whistles and
more elegantly designed as a slot-in solution :)

So we would probably be able to move over to this API very easily.

Yours,
Linus Walleij