All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tzung-Bi Shih <tzungbi@kernel.org>
To: Bartosz Golaszewski <brgl@kernel.org>
Cc: Jonathan Corbet <corbet@lwn.net>, Shuah Khan <shuah@kernel.org>,
	linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
	chrome-platform@lists.linux.dev, linux-kselftest@vger.kernel.org,
	Laurent Pinchart <laurent.pinchart@ideasonboard.com>,
	Wolfram Sang <wsa+renesas@sang-engineering.com>,
	Simona Vetter <simona.vetter@ffwll.ch>,
	Dan Williams <dan.j.williams@intel.com>,
	Jason Gunthorpe <jgg@nvidia.com>,
	linux-gpio@vger.kernel.org, stable@vger.kernel.org,
	Benson Leung <bleung@chromium.org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	"Rafael J . Wysocki" <rafael@kernel.org>,
	Danilo Krummrich <dakr@kernel.org>,
	Bartosz Golaszewski <brgl@bgdev.pl>,
	Linus Walleij <linusw@kernel.org>
Subject: Re: [PATCH 01/23] gpiolib: Correct wrong kfree() usage for `kobj->name`
Date: Tue, 20 Jan 2026 04:29:54 +0000	[thread overview]
Message-ID: <aW8EwgEJ8XgwGhQ-@google.com> (raw)
In-Reply-To: <CAMRc=MeiQho5mfxGsL1AZ60brCzfox64XQao=xWnxMsdHF2-vA@mail.gmail.com>

On Fri, Jan 16, 2026 at 01:15:17PM +0000, Bartosz Golaszewski wrote:
> On Fri, 16 Jan 2026 09:10:14 +0100, Tzung-Bi Shih <tzungbi@kernel.org> said:
> > `kobj->name` should be freed by kfree_const()[1][2].  Correct it.
> >
> > [1] https://elixir.bootlin.com/linux/v6.18/source/lib/kasprintf.c#L41
> > [2] https://elixir.bootlin.com/linux/v6.18/source/lib/kobject.c#L695
> >
> 
> Please don't add links third-party groks to git commit messages.
> 
> > Cc: stable@vger.kernel.org
> > Fixes: c351bb64cbe6 ("gpiolib: free device name on error path to fix kmemleak")
> > Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
> > ---
> >  drivers/gpio/gpiolib.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
> > index 5eb918da7ea2..ba9323432e3a 100644
> > --- a/drivers/gpio/gpiolib.c
> > +++ b/drivers/gpio/gpiolib.c
> > @@ -1263,7 +1263,7 @@ int gpiochip_add_data_with_key(struct gpio_chip *gc, void *data,
> >  err_free_descs:
> >  	kfree(gdev->descs);
> >  err_free_dev_name:
> > -	kfree(dev_name(&gdev->dev));
> > +	kfree_const(dev_name(&gdev->dev));
> >  err_free_ida:
> >  	ida_free(&gpio_ida, gdev->id);
> >  err_free_gdev:
> > --
> > 2.52.0.457.g6b5491de43-goog
> >
> >
> 
> I've never paid attention to this bit but it really looks broken. I understand
> that this string won't get freed until we initialize refcounting on the
> underlying kobject but reaching two abstraction layers below to get the string
> for freeing out of the kobject looks incorrect to me.
> 
> It's also one of only two instances of doing kfree(dev_name(dev)), the other
> one being in drivers/scsi/hosts.c.
> 
> It looks to me that the device name is not really used in

The device name is indeed used in gpiochip_add_data_with_key().  E.g.,
gpiochip_get_ngpios() -> dev_err().

> gpiochip_add_data_with_key(). Can we move dev_set_name() after
> device_initialize()?

Sounds a good idea.  I'll try to approach it in accompany with the
aggressive patch 03/23.

  parent reply	other threads:[~2026-01-20  4:29 UTC|newest]

Thread overview: 49+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-01-16  8:10 [PATCH 00/23] gpiolib: Adopt revocable mechanism for UAF prevention Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 01/23] gpiolib: Correct wrong kfree() usage for `kobj->name` Tzung-Bi Shih
2026-01-16 13:15   ` Bartosz Golaszewski
2026-01-16 13:27     ` Greg Kroah-Hartman
2026-01-16 13:30       ` Bartosz Golaszewski
2026-01-20  4:29     ` Tzung-Bi Shih [this message]
2026-01-16 14:13   ` Jason Gunthorpe
2026-01-16 14:38     ` Bartosz Golaszewski
2026-01-20  4:30       ` Tzung-Bi Shih
2026-01-20  9:43         ` Bartosz Golaszewski
2026-01-16  8:10 ` [PATCH 02/23] gpiolib: cdev: Fix resource leaks on errors in gpiolib_cdev_register() Tzung-Bi Shih
2026-01-20  8:50   ` Bartosz Golaszewski
2026-01-20  9:34     ` Tzung-Bi Shih
2026-01-20  9:39       ` Bartosz Golaszewski
2026-01-16  8:10 ` [PATCH 03/23] gpiolib: Fix resource leaks on errors in gpiochip_add_data_with_key() Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 04/23] gpiolib: Fix resource leaks on errors in lineinfo_changed_notify() Tzung-Bi Shih
2026-01-16 13:26   ` Bartosz Golaszewski
2026-01-20  3:11     ` Tzung-Bi Shih
2026-01-20  8:49       ` Bartosz Golaszewski
2026-01-16  8:10 ` [PATCH 05/23] gpiolib: cdev: Correct return code on memory allocation failure Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 06/23] gpiolib: Access `gpio_bus_type` in gpiochip_setup_dev() Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 07/23] gpiolib: Remove redundant check for struct gpio_chip Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 08/23] gpiolib: sysfs: " Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 09/23] gpiolib: Ensure struct gpio_chip for gpiochip_setup_dev() Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 10/23] gpiolib: cdev: Don't check struct gpio_chip in gpio_chrdev_open() Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 11/23] selftests: gpio: Add gpio-cdev-uaf tests Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 12/23] gpiolib: Add revocable provider handle for struct gpio_chip Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 13/23] gpiolib: cdev: Leverage revocable for gpio_fileops Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 14/23] gpiolib: cdev: Leverage revocable for linehandle_fileops Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 15/23] gpiolib: cdev: Leverage revocable for line_fileops Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 16/23] gpiolib: cdev: Leverage revocable for lineevent_fileops Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 17/23] gpiolib: cdev: Leverage revocable for lineinfo_changed_notify Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 18/23] gpiolib: Leverage revocable for gpiolib_sops Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 19/23] revocable: Support to define revocable consumer handle on stack Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 20/23] revocable: Add Kunit test case for DEFINE_REVOCABLE() Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 21/23] selftests: revocable: Add " Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 22/23] gpiolib: Leverage revocable for other independent lifecycle instances Tzung-Bi Shih
2026-01-24 16:52   ` Johan Hovold
2026-01-26 13:58     ` Johan Hovold
2026-01-27 15:56       ` Tzung-Bi Shih
2026-01-16  8:10 ` [PATCH 23/23] gpiolib: Remove unused `chip` and `srcu` in struct gpio_device Tzung-Bi Shih
2026-01-16 10:35 ` [PATCH 00/23] gpiolib: Adopt revocable mechanism for UAF prevention Bartosz Golaszewski
2026-01-16 16:07   ` Laurent Pinchart
2026-01-17 12:48   ` Tzung-Bi Shih
2026-01-19  8:33     ` Bartosz Golaszewski
2026-01-21  4:17       ` Tzung-Bi Shih
2026-01-21 10:42         ` Bartosz Golaszewski
2026-01-19 14:21 ` (subset) " Bartosz Golaszewski
2026-01-20  3:13   ` Tzung-Bi Shih

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aW8EwgEJ8XgwGhQ-@google.com \
    --to=tzungbi@kernel.org \
    --cc=bleung@chromium.org \
    --cc=brgl@bgdev.pl \
    --cc=brgl@kernel.org \
    --cc=chrome-platform@lists.linux.dev \
    --cc=corbet@lwn.net \
    --cc=dakr@kernel.org \
    --cc=dan.j.williams@intel.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=jgg@nvidia.com \
    --cc=laurent.pinchart@ideasonboard.com \
    --cc=linusw@kernel.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-gpio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=rafael@kernel.org \
    --cc=shuah@kernel.org \
    --cc=simona.vetter@ffwll.ch \
    --cc=stable@vger.kernel.org \
    --cc=wsa+renesas@sang-engineering.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.