Kernel debugfs string helper headed read-only after double-free

A double-free in the Linux kernel's debugfs string helper has pushed maintainers to strip write support from the generic API instead of bolting on more synchronization.

Yichong Chen reported that concurrent writers to a file created with debugfs_create_str() can both see the same old string pointer, replace it, and free it twice after the RCU grace period. KASAN flagged the bug. Writeable in-tree users are few: interconnect test-client node names and a SoundWire firmware filename path.

Chen first proposed a global mutex around writers plus stricter RCU use on the read side. Greg Kroah-Hartman rejected that approach. A single lock across every debugfs string is too coarse, mixing it with RCU muddies the helper further, and the string write path has a history of similar trouble. With only a handful of writable callers, he preferred making the helper read-only and forcing those users to supply their own simple file operations.

Chen is converting the SoundWire firmware debugfs entry to a local write path and changing debugfs_create_str() so it no longer accepts write mode. Kroah-Hartman agreed with the direction: migrate the remaining write users first, then make the generic helper refuse write bits outright (failing creation if the caller asks for write, rather than silently stripping them). Out-of-tree code that still depends on writable debugfs strings will need the same treatment.

The practical effect is a smaller, simpler debugfs string API and one less concurrency footgun in a debugging interface that is root-only but still reachable from ordinary driver debug nodes.