[PATCH v2] regmap: debugfs: fix race condition in dummy name allocation

[PATCH v2] regmap: debugfs: fix race condition in dummy name allocation

[Zxyan Zhu]

Use IDA instead of a simple counter for generating unique dummy names.
The previous implementation used dummy_index++ which is not atomic,
leading to potential duplicate names when multiple threads call
regmap_debugfs_init() concurrently with name="dummy".

Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
---
 drivers/base/regmap/internal.h       |  1 +
 drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++-----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 5bf993165438..e067890866c1 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -84,6 +84,7 @@ struct regmap {
 	bool debugfs_disable;
 	struct dentry *debugfs;
 	const char *debugfs_name;
+	int debugfs_dummy_id;
 
 	unsigned int debugfs_reg_len;
 	unsigned int debugfs_val_len;
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 5a46ce5fee72..18f1c60749fe 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/idr.h>
 
 #include "internal.h"
 
@@ -20,7 +21,7 @@ struct regmap_debugfs_node {
 	struct list_head link;
 };
 
-static unsigned int dummy_index;
+static DEFINE_IDA(dummy_ida);
 static struct dentry *regmap_debugfs_root;
 static LIST_HEAD(regmap_debugfs_early_list);
 static DEFINE_MUTEX(regmap_debugfs_early_lock);
@@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map)
 	struct regmap_range_node *range_node;
 	const char *devname = "dummy";
 	const char *name = map->name;
+	int id;
 
 	/*
 	 * Userspace can initiate reads from the hardware over debugfs.
@@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map)
 
 	INIT_LIST_HEAD(&map->debugfs_off_cache);
 	mutex_init(&map->cache_lock);
+	map->debugfs_dummy_id = -1;
 
 	if (map->dev)
 		devname = dev_name(map->dev);
@@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map)
 
 	if (!strcmp(name, "dummy")) {
 		kfree(map->debugfs_name);
-		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
-						dummy_index);
-		if (!map->debugfs_name)
+		id = ida_alloc(&dummy_ida, GFP_KERNEL);
+		if (id < 0)
 			return;
+		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id);
+		if (!map->debugfs_name) {
+			ida_free(&dummy_ida, id);
+			return;
+		}
+		map->debugfs_dummy_id = id;
 		name = map->debugfs_name;
-		dummy_index++;
 	}
 
 	map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
@@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map)
 		mutex_lock(&map->cache_lock);
 		regmap_debugfs_free_dump_cache(map);
 		mutex_unlock(&map->cache_lock);
+		if (map->debugfs_dummy_id >= 0) {
+			ida_free(&dummy_ida, map->debugfs_dummy_id);
+			map->debugfs_dummy_id = -1;
+		}
 		kfree(map->debugfs_name);
 		map->debugfs_name = NULL;
 	} else {
-- 
2.34.1

Re: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation

[Greg Kroah-Hartman]

On Thu, Apr 09, 2026 at 11:50:15AM +0800, Zxyan Zhu wrote:
> Use IDA instead of a simple counter for generating unique dummy names.
> The previous implementation used dummy_index++ which is not atomic,
> leading to potential duplicate names when multiple threads call
> regmap_debugfs_init() concurrently with name="dummy".
> 
> Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
> ---
>  drivers/base/regmap/internal.h       |  1 +
>  drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++-----
>  2 files changed, 17 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
> index 5bf993165438..e067890866c1 100644
> --- a/drivers/base/regmap/internal.h
> +++ b/drivers/base/regmap/internal.h
> @@ -84,6 +84,7 @@ struct regmap {
>  	bool debugfs_disable;
>  	struct dentry *debugfs;
>  	const char *debugfs_name;
> +	int debugfs_dummy_id;
>  
>  	unsigned int debugfs_reg_len;
>  	unsigned int debugfs_val_len;
> diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
> index 5a46ce5fee72..18f1c60749fe 100644
> --- a/drivers/base/regmap/regmap-debugfs.c
> +++ b/drivers/base/regmap/regmap-debugfs.c
> @@ -12,6 +12,7 @@
>  #include <linux/uaccess.h>
>  #include <linux/device.h>
>  #include <linux/list.h>
> +#include <linux/idr.h>
>  
>  #include "internal.h"
>  
> @@ -20,7 +21,7 @@ struct regmap_debugfs_node {
>  	struct list_head link;
>  };
>  
> -static unsigned int dummy_index;
> +static DEFINE_IDA(dummy_ida);
>  static struct dentry *regmap_debugfs_root;
>  static LIST_HEAD(regmap_debugfs_early_list);
>  static DEFINE_MUTEX(regmap_debugfs_early_lock);
> @@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map)
>  	struct regmap_range_node *range_node;
>  	const char *devname = "dummy";
>  	const char *name = map->name;
> +	int id;
>  
>  	/*
>  	 * Userspace can initiate reads from the hardware over debugfs.
> @@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map)
>  
>  	INIT_LIST_HEAD(&map->debugfs_off_cache);
>  	mutex_init(&map->cache_lock);
> +	map->debugfs_dummy_id = -1;
>  
>  	if (map->dev)
>  		devname = dev_name(map->dev);
> @@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map)
>  
>  	if (!strcmp(name, "dummy")) {
>  		kfree(map->debugfs_name);
> -		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
> -						dummy_index);
> -		if (!map->debugfs_name)
> +		id = ida_alloc(&dummy_ida, GFP_KERNEL);
> +		if (id < 0)
>  			return;
> +		map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id);
> +		if (!map->debugfs_name) {
> +			ida_free(&dummy_ida, id);
> +			return;
> +		}
> +		map->debugfs_dummy_id = id;
>  		name = map->debugfs_name;
> -		dummy_index++;
>  	}
>  
>  	map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
> @@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map)
>  		mutex_lock(&map->cache_lock);
>  		regmap_debugfs_free_dump_cache(map);
>  		mutex_unlock(&map->cache_lock);
> +		if (map->debugfs_dummy_id >= 0) {
> +			ida_free(&dummy_ida, map->debugfs_dummy_id);
> +			map->debugfs_dummy_id = -1;
> +		}
>  		kfree(map->debugfs_name);
>  		map->debugfs_name = NULL;
>  	} else {
> -- 
> 2.34.1
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot

Re: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation

[Mark Brown]

On Thu, 09 Apr 2026 11:50:15 +0800, Zxyan Zhu wrote:
> regmap: debugfs: fix race condition in dummy name allocation

Applied to

   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap.git for-7.1

Thanks!

[1/1] regmap: debugfs: fix race condition in dummy name allocation
      https://git.kernel.org/broonie/regmap/c/7d696210cf36

All being well this means that it will be integrated into the linux-next
tree (usually sometime in the next 24 hours) and sent to Linus during
the next merge window (or sooner if it is a bug fix), however if
problems are discovered then the patch may be dropped or reverted.

You may get further e-mails resulting from automated or manual testing
and review of the tree, please engage with people reporting problems and
send followup patches addressing any issues that are reported if needed.

If any updates are required or you are submitting further changes they
should be sent as incremental updates against current git, existing
patches will not be replaced.

Please add any relevant lists and maintainers to the CCs when replying
to this mail.

Thanks,
Mark

Re: [PATCH] regmap: debugfs: fix race condition in dummy name allocation

[zhu xin]

Sorry, I missed adding Cc in the previous send. Resending the correct
v2 patch below.

On Wed, Apr 08, 2026 at 09:11:55PM +0800, Greg Kroah-Hartman wrote:
> What code does that?  Why not fix that?

Multiple drivers using regmap can probe in parallel, leading to
concurrent calls to regmap_debugfs_init() with name=NULL and dev=NULL.
The dummy_index is a global static variable inside regmap-debugfs.c,
not something the callers have knowledge of or control over. Using IDA
is the appropriate fix for this internal concurrency issue.

> Also, you did not sign off on this, so it can't be taken, sorry.

Apologies for missing the Signed-off-by line. Added in v2.

From 7f7d322d6605a1b2c3d4e5f6g7h8i9j0k1l2m3n4 Mon Sep 17 00:00:00 2001
From: Zxyan Zhu <zxyan0222@gmail.com>
Date: Thu, 9 Apr 2026 13:40:11 +0800
Subject: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation

When multiple drivers using regmap probe in parallel, they may call
regmap_debugfs_init() concurrently with name=NULL and dev=NULL,
resulting in concurrent access to the global dummy_index counter.
This could lead to duplicate debugfs directory names like "dummy0"
being created, causing debugfs_create_dir() to fail.

Fix this by replacing the non-atomic dummy_index counter with IDA,
which provides thread-safe ID allocation.

Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
---
Changes in v2:
  - Add missing Signed-off-by line
  - Improve commit message with detailed problem description
---
 drivers/base/regmap/internal.h       |  1 +
 drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++-----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 5bf993165438..e067890866c1 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -84,6 +84,7 @@ struct regmap {
        bool debugfs_disable;
        struct dentry *debugfs;
        const char *debugfs_name;
+       int debugfs_dummy_id;

        unsigned int debugfs_reg_len;
        unsigned int debugfs_val_len;
diff --git a/drivers/base/regmap/regmap-debugfs.c
b/drivers/base/regmap/regmap-debugfs.c
index 5a46ce5fee72..18f1c60749fe 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -12,6 +12,7 @@
 #include <linux/uaccess.h>
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/idr.h>

 #include "internal.h"

@@ -20,7 +21,7 @@ struct regmap_debugfs_node {
        struct list_head link;
 };

-static unsigned int dummy_index;
+static DEFINE_IDA(dummy_ida);
 static struct dentry *regmap_debugfs_root;
 static LIST_HEAD(regmap_debugfs_early_list);
 static DEFINE_MUTEX(regmap_debugfs_early_lock);
@@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map)
        struct regmap_range_node *range_node;
        const char *devname = "dummy";
        const char *name = map->name;
+       int id;

        /*
         * Userspace can initiate reads from the hardware over debugfs.
@@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map)

        INIT_LIST_HEAD(&map->debugfs_off_cache);
        mutex_init(&map->cache_lock);
+       map->debugfs_dummy_id = -1;

        if (map->dev)
                devname = dev_name(map->dev);
@@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map)

        if (!strcmp(name, "dummy")) {
                kfree(map->debugfs_name);
-               map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
-                                               dummy_index);
-               if (!map->debugfs_name)
+               id = ida_alloc(&dummy_ida, GFP_KERNEL);
+               if (id < 0)
                        return;
+               map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id);
+               if (!map->debugfs_name) {
+                       ida_free(&dummy_ida, id);
+                       return;
+               }
+               map->debugfs_dummy_id = id;
                name = map->debugfs_name;
-               dummy_index++;
        }

        map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
@@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map)
                mutex_lock(&map->cache_lock);
                regmap_debugfs_free_dump_cache(map);
                mutex_unlock(&map->cache_lock);
+               if (map->debugfs_dummy_id >= 0) {
+                       ida_free(&dummy_ida, map->debugfs_dummy_id);
+                       map->debugfs_dummy_id = -1;
+               }
                kfree(map->debugfs_name);
                map->debugfs_name = NULL;
        } else {
--
2.34.1


On Wed, Apr 8, 2026 at 9:33 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Apr 08, 2026 at 09:11:55PM +0800, Zxyan Zhu wrote:
> > Use IDA instead of a simple counter for generating unique dummy names.
> > The previous implementation used dummy_index++ which is not atomic,
> > leading to potential duplicate names when multiple threads call
> > regmap_debugfs_init() concurrently with name="dummy".
>
> What code does that?  Why not fix that?
>
> Also, you did not sign off on this, so it can't be taken, sorry.
>
> greg k-h