interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

Posted by Gui-Dong Han 2 weeks, 5 days ago

debugfs_write_file_str() uses standard kfree() to release old strings.
Initializing src_node and dst_node with devm_kstrdup() creates a memory
management mismatch. If a user writes to these debugfs nodes, the
devm-allocated memory is freed via kfree(), leaving a dangling pointer
in the device resource list that can lead to a double free.

Fix this by using standard kstrdup() instead. Since the interconnect
subsystem is strictly built-in and cannot be unloaded as a module, there
is no exit path requiring manual cleanup of these strings. The error
handling path is also simplified by taking advantage of the fact that
kfree(NULL) is a safe no-op.

Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
---
I noticed this memory management mismatch while working on similar
debugfs string initialization fixes [1] recently.

[1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/
---
 drivers/interconnect/debugfs-client.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
index 5107bff53173..08df9188ef94 100644
--- a/drivers/interconnect/debugfs-client.c
+++ b/drivers/interconnect/debugfs-client.c
@@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
 		return ret;
 	}
 
-	src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
-	dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
-	if (!src_node || !dst_node)
+	src_node = kstrdup("", GFP_KERNEL);
+	dst_node = kstrdup("", GFP_KERNEL);
+	if (!src_node || !dst_node) {
+		kfree(dst_node);
+		kfree(src_node);
 		return -ENOMEM;
+	}
 
 	client_dir = debugfs_create_dir("test_client", icc_dir);
 
-- 
2.43.0

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

Posted by Gui-Dong Han 4 days, 3 hours ago

On Wed, Mar 18, 2026 at 10:48 AM Gui-Dong Han <hanguidong02@gmail.com> wrote:
>
> debugfs_write_file_str() uses standard kfree() to release old strings.
> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.
>
> Fix this by using standard kstrdup() instead. Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings. The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.
>
> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
> ---
> I noticed this memory management mismatch while working on similar
> debugfs string initialization fixes [1] recently.
>
> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/

Hello Georgi,

Gentle ping on this patch.

Just wanted to note that my other related fix has already been accepted [1].

Could you please let me know if this fell through the cracks, or if
you have any feedback or modification requests? I'd be very happy to
address them.

Thanks.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git/commit/?h=driver-core-testing&id=31de83980d37

> ---
>  drivers/interconnect/debugfs-client.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
> index 5107bff53173..08df9188ef94 100644
> --- a/drivers/interconnect/debugfs-client.c
> +++ b/drivers/interconnect/debugfs-client.c
> @@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
>                 return ret;
>         }
>
> -       src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -       dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -       if (!src_node || !dst_node)
> +       src_node = kstrdup("", GFP_KERNEL);
> +       dst_node = kstrdup("", GFP_KERNEL);
> +       if (!src_node || !dst_node) {
> +               kfree(dst_node);
> +               kfree(src_node);
>                 return -ENOMEM;
> +       }
>
>         client_dir = debugfs_create_dir("test_client", icc_dir);
>
> --
> 2.43.0
>

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

Posted by Georgi Djakov 4 days, 3 hours ago

On 4/2/26 6:42 PM, Gui-Dong Han wrote:
> On Wed, Mar 18, 2026 at 10:48 AM Gui-Dong Han <hanguidong02@gmail.com> wrote:
>>
>> debugfs_write_file_str() uses standard kfree() to release old strings.
>> Initializing src_node and dst_node with devm_kstrdup() creates a memory
>> management mismatch. If a user writes to these debugfs nodes, the
>> devm-allocated memory is freed via kfree(), leaving a dangling pointer
>> in the device resource list that can lead to a double free.
>>
>> Fix this by using standard kstrdup() instead. Since the interconnect
>> subsystem is strictly built-in and cannot be unloaded as a module, there
>> is no exit path requiring manual cleanup of these strings. The error
>> handling path is also simplified by taking advantage of the fact that
>> kfree(NULL) is a safe no-op.
>>
>> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
>> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
>> ---
>> I noticed this memory management mismatch while working on similar
>> debugfs string initialization fixes [1] recently.
>>
>> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/
> 
> Hello Georgi,
> 
> Gentle ping on this patch.
> 
> Just wanted to note that my other related fix has already been accepted [1].
> 
> Could you please let me know if this fell through the cracks, or if
> you have any feedback or modification requests? I'd be very happy to
> address them.

Hello,

Thanks for the patch! I applied it already and it's available in today's linux-next.

Thanks,
Georgi

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

Posted by Markus Elfring 2 weeks, 1 day ago

> debugfs_write_file_str() uses standard kfree() to release old strings.

Why would such information matter here?


> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.

Would an other description approach be clearer for involved dependencies?


> Fix this by using standard kstrdup() instead.

Interesting …

https://elixir.bootlin.com/linux/v7.0-rc4/source/drivers/interconnect/debugfs-client.c#L139-L169


>                                               Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings.

Should string lifetimes be reconsidered for the mentioned function implementation?


>                                                            The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.

I tend to interpret source code simplifications in other directions.


See also once more:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.0-rc4#n34

Regards,
Markus

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

Posted by Kuan-Wei Chiu 2 weeks, 5 days ago

On Wed, Mar 18, 2026 at 10:48:15AM +0800, Gui-Dong Han wrote:
> debugfs_write_file_str() uses standard kfree() to release old strings.
> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.
> 
> Fix this by using standard kstrdup() instead. Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings. The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.
> 
> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>

LGTM. Thanks for the patch.

Reviewed-by: Kuan-Wei Chiu <visitorckw@gmail.com>

Regards,
Kuan-Wei

> ---
> I noticed this memory management mismatch while working on similar
> debugfs string initialization fixes [1] recently.
> 
> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/
> ---
>  drivers/interconnect/debugfs-client.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
> index 5107bff53173..08df9188ef94 100644
> --- a/drivers/interconnect/debugfs-client.c
> +++ b/drivers/interconnect/debugfs-client.c
> @@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
>  		return ret;
>  	}
>  
> -	src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	if (!src_node || !dst_node)
> +	src_node = kstrdup("", GFP_KERNEL);
> +	dst_node = kstrdup("", GFP_KERNEL);
> +	if (!src_node || !dst_node) {
> +		kfree(dst_node);
> +		kfree(src_node);
>  		return -ENOMEM;
> +	}
>  
>  	client_dir = debugfs_create_dir("test_client", icc_dir);
>  
> -- 
> 2.43.0
>