CVE-2025-21943

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: aggregator: protect driver attr handlers against module unload<br /> <br /> Both new_device_store and delete_device_store touch module global<br /> resources (e.g. gpio_aggregator_lock). To prevent race conditions with<br /> module unload, a reference needs to be held.<br /> <br /> Add try_module_get() in these handlers.<br /> <br /> For new_device_store, this eliminates what appears to be the most dangerous<br /> scenario: if an id is allocated from gpio_aggregator_idr but<br /> platform_device_register has not yet been called or completed, a concurrent<br /> module unload could fail to unregister/delete the device, leaving behind a<br /> dangling platform device/GPIO forwarder. This can result in various issues.<br /> The following simple reproducer demonstrates these problems:<br /> <br /> #!/bin/bash<br /> while :; do<br /> # note: whether &amp;#39;gpiochip0 0&amp;#39; exists or not does not matter.<br /> echo &amp;#39;gpiochip0 0&amp;#39; &gt; /sys/bus/platform/drivers/gpio-aggregator/new_device<br /> done &amp;<br /> while :; do<br /> modprobe gpio-aggregator<br /> modprobe -r gpio-aggregator<br /> done &amp;<br /> wait<br /> <br /> Starting with the following warning, several kinds of warnings will appear<br /> and the system may become unstable:<br /> <br /> ------------[ cut here ]------------<br /> list_del corruption, ffff888103e2e980-&gt;next is LIST_POISON1 (dead000000000100)<br /> WARNING: CPU: 1 PID: 1327 at lib/list_debug.c:56 __list_del_entry_valid_or_report+0xa3/0x120<br /> [...]<br /> RIP: 0010:__list_del_entry_valid_or_report+0xa3/0x120<br /> [...]<br /> Call Trace:<br /> <br /> ? __list_del_entry_valid_or_report+0xa3/0x120<br /> ? __warn.cold+0x93/0xf2<br /> ? __list_del_entry_valid_or_report+0xa3/0x120<br /> ? report_bug+0xe6/0x170<br /> ? __irq_work_queue_local+0x39/0xe0<br /> ? handle_bug+0x58/0x90<br /> ? exc_invalid_op+0x13/0x60<br /> ? asm_exc_invalid_op+0x16/0x20<br /> ? __list_del_entry_valid_or_report+0xa3/0x120<br /> gpiod_remove_lookup_table+0x22/0x60<br /> new_device_store+0x315/0x350 [gpio_aggregator]<br /> kernfs_fop_write_iter+0x137/0x1f0<br /> vfs_write+0x262/0x430<br /> ksys_write+0x60/0xd0<br /> do_syscall_64+0x6c/0x180<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> [...]<br /> <br /> ---[ end trace 0000000000000000 ]---