Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

char: Use list_del_init() in misc_deregister() to reinitialize list pointer

Currently, misc_deregister() uses list_del() to remove the device
from the list. After list_del(), the list pointers are set to
LIST_POISON1 and LIST_POISON2, which may help catch use-after-free bugs,
but does not reset the list head.
If misc_deregister() is called more than once on the same device,
list_empty() will not return true, and list_del() may be called again,
leading to undefined behavior.

Replace list_del() with list_del_init() to reinitialize the list head
after deletion. This makes the code more robust against double
deregistration and allows safe usage of list_empty() on the miscdevice
after deregistration.

[ Note, this seems to keep broken out-of-tree drivers from doing foolish
things. While this does not matter for any in-kernel drivers,
external drivers could use a bit of help to show them they shouldn't
be doing stuff like re-registering misc devices - gregkh ]

Signed-off-by: Xion Wang <xion.wang@mediatek.com>
Link: https://lore.kernel.org/r/20250904063714.28925-2-xion.wang@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Xion Wang and committed by
Greg Kroah-Hartman
e2802287 ceda408c

+1 -1
+1 -1
drivers/char/misc.c
··· 284 284 void misc_deregister(struct miscdevice *misc) 285 285 { 286 286 mutex_lock(&misc_mtx); 287 - list_del(&misc->list); 287 + list_del_init(&misc->list); 288 288 device_destroy(&misc_class, MKDEV(MISC_MAJOR, misc->minor)); 289 289 misc_minor_free(misc->minor); 290 290 if (misc->minor > MISC_DYNAMIC_MINOR)