Debugfs string I/O races fixed after KASAN double-free repro

Two race conditions in the Linux kernel's debugfs string file helpers left concurrent readers and writers exposed to use-after-free and double-free bugs. Aldo Ariel Panzardo has posted fixes aimed at mainline and stable kernels.

Debugfs string files publish updates with RCU, then free the previous buffer after a grace period. The read path loaded that pointer and copied the string without an RCU read-side critical section, so a writer could finish its grace period and free the buffer while a reader still used it. Separately, concurrent writers could both capture the same old pointer before either published a replacement, then both free it.

The first fix holds an RCU read lock around the dereference and copy so the buffer cannot disappear mid-read. The second serializes writers with the inode lock, loads the old pointer under that lock, and drops the lock before the grace period and free so readers are not stalled.

Panzardo credited sashiko.dev with flagging the mismatched RCU usage on the write side; he then found the missing writer exclusion by review. Under KASAN on QEMU with 7.3-rc4, eight concurrent writers produced thousands of double-free reports in a single run. The narrower read-side window did not trip KASAN but follows directly from the incomplete RCU pairing.

Greg Kroah-Hartman asked for testing details, kernel version, and a split into separate patches. Panzardo reworked the series accordingly and marked both changes for stable. Debugfs is widely used for kernel debugging interfaces; the bugs matter wherever user space can open the same string file from multiple threads or processes.