CVE-2025-21943

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: protect driver attr handlers against module unload

Both newdevicestore and deletedevicestore touch module global resources (e.g. gpioaggregatorlock). To prevent race conditions with module unload, a reference needs to be held.

Add trymoduleget() in these handlers.

For newdevicestore, this eliminates what appears to be the most dangerous scenario: if an id is allocated from gpioaggregatoridr but platformdeviceregister has not yet been called or completed, a concurrent module unload could fail to unregister/delete the device, leaving behind a dangling platform device/GPIO forwarder. This can result in various issues. The following simple reproducer demonstrates these problems:

#!/bin/bash while :; do # note: whether 'gpiochip0 0' exists or not does not matter. echo 'gpiochip0 0' > /sys/bus/platform/drivers/gpio-aggregator/new_device done & while :; do modprobe gpio-aggregator modprobe -r gpio-aggregator done & wait

Starting with the following warning, several kinds of warnings will appear and the system may become unstable:

------------[ cut here ]------------ listdel corruption, ffff888103e2e980->next is LISTPOISON1 (dead000000000100) WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __listdelentryvalidor_report+0xa3/0x120 [...] RIP: 0010:__listdelentryvalidor_report+0xa3/0x120 [...] Call Trace: <TASK> ? __listdelentryvalidor_report+0xa3/0x120 ? __warn.cold+0x93/0xf2 ? __listdelentryvalidorreport+0xa3/0x120 ? reportbug+0xe6/0x170 ? __irqworkqueuelocal+0x39/0xe0 ? handlebug+0x58/0x90 ? excinvalidop+0x13/0x60 ? asmexcinvalid_op+0x16/0x20 ? __listdelentryvalidorreport+0xa3/0x120 gpiodremovelookuptable+0x22/0x60 newdevicestore+0x315/0x350 [gpioaggregator] kernfsfopwriteiter+0x137/0x1f0 vfswrite+0x262/0x430 ksyswrite+0x60/0xd0 dosyscall64+0x6c/0x180 entrySYSCALL64afterhwframe+0x76/0x7e [...] </TASK> ---[ end trace 0000000000000000 ]---