* [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation
[not found] ` <2026040834-runaround-glass-8ea6@gregkh>
@ 2026-04-09 3:50 ` Zxyan Zhu
2026-04-09 5:39 ` Greg Kroah-Hartman
2026-04-09 19:51 ` Mark Brown
2026-04-09 6:10 ` [PATCH] " zhu xin
1 sibling, 2 replies; 4+ messages in thread
From: Zxyan Zhu @ 2026-04-09 3:50 UTC (permalink / raw)
To: Mark Brown, Greg Kroah-Hartman
Cc: Rafael J . Wysocki, Danilo Krummrich, linux-kernel, driver-core,
Zxyan Zhu
Use IDA instead of a simple counter for generating unique dummy names.
The previous implementation used dummy_index++ which is not atomic,
leading to potential duplicate names when multiple threads call
regmap_debugfs_init() concurrently with name="dummy".
Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
---
drivers/base/regmap/internal.h | 1 +
drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++-----
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 5bf993165438..e067890866c1 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -84,6 +84,7 @@ struct regmap {
bool debugfs_disable;
struct dentry *debugfs;
const char *debugfs_name;
+ int debugfs_dummy_id;
unsigned int debugfs_reg_len;
unsigned int debugfs_val_len;
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 5a46ce5fee72..18f1c60749fe 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -12,6 +12,7 @@
#include <linux/uaccess.h>
#include <linux/device.h>
#include <linux/list.h>
+#include <linux/idr.h>
#include "internal.h"
@@ -20,7 +21,7 @@ struct regmap_debugfs_node {
struct list_head link;
};
-static unsigned int dummy_index;
+static DEFINE_IDA(dummy_ida);
static struct dentry *regmap_debugfs_root;
static LIST_HEAD(regmap_debugfs_early_list);
static DEFINE_MUTEX(regmap_debugfs_early_lock);
@@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map)
struct regmap_range_node *range_node;
const char *devname = "dummy";
const char *name = map->name;
+ int id;
/*
* Userspace can initiate reads from the hardware over debugfs.
@@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map)
INIT_LIST_HEAD(&map->debugfs_off_cache);
mutex_init(&map->cache_lock);
+ map->debugfs_dummy_id = -1;
if (map->dev)
devname = dev_name(map->dev);
@@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map)
if (!strcmp(name, "dummy")) {
kfree(map->debugfs_name);
- map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
- dummy_index);
- if (!map->debugfs_name)
+ id = ida_alloc(&dummy_ida, GFP_KERNEL);
+ if (id < 0)
return;
+ map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id);
+ if (!map->debugfs_name) {
+ ida_free(&dummy_ida, id);
+ return;
+ }
+ map->debugfs_dummy_id = id;
name = map->debugfs_name;
- dummy_index++;
}
map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
@@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map)
mutex_lock(&map->cache_lock);
regmap_debugfs_free_dump_cache(map);
mutex_unlock(&map->cache_lock);
+ if (map->debugfs_dummy_id >= 0) {
+ ida_free(&dummy_ida, map->debugfs_dummy_id);
+ map->debugfs_dummy_id = -1;
+ }
kfree(map->debugfs_name);
map->debugfs_name = NULL;
} else {
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] regmap: debugfs: fix race condition in dummy name allocation
[not found] ` <2026040834-runaround-glass-8ea6@gregkh>
2026-04-09 3:50 ` [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation Zxyan Zhu
@ 2026-04-09 6:10 ` zhu xin
1 sibling, 0 replies; 4+ messages in thread
From: zhu xin @ 2026-04-09 6:10 UTC (permalink / raw)
To: Greg KH
Cc: Mark Brown, Rafael J. Wysocki, Danilo Krummrich, linux-kernel,
driver-core
Sorry, I missed adding Cc in the previous send. Resending the correct
v2 patch below.
On Wed, Apr 08, 2026 at 09:11:55PM +0800, Greg Kroah-Hartman wrote:
> What code does that? Why not fix that?
Multiple drivers using regmap can probe in parallel, leading to
concurrent calls to regmap_debugfs_init() with name=NULL and dev=NULL.
The dummy_index is a global static variable inside regmap-debugfs.c,
not something the callers have knowledge of or control over. Using IDA
is the appropriate fix for this internal concurrency issue.
> Also, you did not sign off on this, so it can't be taken, sorry.
Apologies for missing the Signed-off-by line. Added in v2.
From 7f7d322d6605a1b2c3d4e5f6g7h8i9j0k1l2m3n4 Mon Sep 17 00:00:00 2001
From: Zxyan Zhu <zxyan0222@gmail.com>
Date: Thu, 9 Apr 2026 13:40:11 +0800
Subject: [PATCH v2] regmap: debugfs: fix race condition in dummy name allocation
When multiple drivers using regmap probe in parallel, they may call
regmap_debugfs_init() concurrently with name=NULL and dev=NULL,
resulting in concurrent access to the global dummy_index counter.
This could lead to duplicate debugfs directory names like "dummy0"
being created, causing debugfs_create_dir() to fail.
Fix this by replacing the non-atomic dummy_index counter with IDA,
which provides thread-safe ID allocation.
Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com>
---
Changes in v2:
- Add missing Signed-off-by line
- Improve commit message with detailed problem description
---
drivers/base/regmap/internal.h | 1 +
drivers/base/regmap/regmap-debugfs.c | 21 ++++++++++++++++-----
2 files changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 5bf993165438..e067890866c1 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -84,6 +84,7 @@ struct regmap {
bool debugfs_disable;
struct dentry *debugfs;
const char *debugfs_name;
+ int debugfs_dummy_id;
unsigned int debugfs_reg_len;
unsigned int debugfs_val_len;
diff --git a/drivers/base/regmap/regmap-debugfs.c
b/drivers/base/regmap/regmap-debugfs.c
index 5a46ce5fee72..18f1c60749fe 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -12,6 +12,7 @@
#include <linux/uaccess.h>
#include <linux/device.h>
#include <linux/list.h>
+#include <linux/idr.h>
#include "internal.h"
@@ -20,7 +21,7 @@ struct regmap_debugfs_node {
struct list_head link;
};
-static unsigned int dummy_index;
+static DEFINE_IDA(dummy_ida);
static struct dentry *regmap_debugfs_root;
static LIST_HEAD(regmap_debugfs_early_list);
static DEFINE_MUTEX(regmap_debugfs_early_lock);
@@ -539,6 +540,7 @@ void regmap_debugfs_init(struct regmap *map)
struct regmap_range_node *range_node;
const char *devname = "dummy";
const char *name = map->name;
+ int id;
/*
* Userspace can initiate reads from the hardware over debugfs.
@@ -567,6 +569,7 @@ void regmap_debugfs_init(struct regmap *map)
INIT_LIST_HEAD(&map->debugfs_off_cache);
mutex_init(&map->cache_lock);
+ map->debugfs_dummy_id = -1;
if (map->dev)
devname = dev_name(map->dev);
@@ -585,12 +588,16 @@ void regmap_debugfs_init(struct regmap *map)
if (!strcmp(name, "dummy")) {
kfree(map->debugfs_name);
- map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d",
- dummy_index);
- if (!map->debugfs_name)
+ id = ida_alloc(&dummy_ida, GFP_KERNEL);
+ if (id < 0)
return;
+ map->debugfs_name = kasprintf(GFP_KERNEL, "dummy%d", id);
+ if (!map->debugfs_name) {
+ ida_free(&dummy_ida, id);
+ return;
+ }
+ map->debugfs_dummy_id = id;
name = map->debugfs_name;
- dummy_index++;
}
map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
@@ -660,6 +667,10 @@ void regmap_debugfs_exit(struct regmap *map)
mutex_lock(&map->cache_lock);
regmap_debugfs_free_dump_cache(map);
mutex_unlock(&map->cache_lock);
+ if (map->debugfs_dummy_id >= 0) {
+ ida_free(&dummy_ida, map->debugfs_dummy_id);
+ map->debugfs_dummy_id = -1;
+ }
kfree(map->debugfs_name);
map->debugfs_name = NULL;
} else {
--
2.34.1
On Wed, Apr 8, 2026 at 9:33 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Apr 08, 2026 at 09:11:55PM +0800, Zxyan Zhu wrote:
> > Use IDA instead of a simple counter for generating unique dummy names.
> > The previous implementation used dummy_index++ which is not atomic,
> > leading to potential duplicate names when multiple threads call
> > regmap_debugfs_init() concurrently with name="dummy".
>
> What code does that? Why not fix that?
>
> Also, you did not sign off on this, so it can't be taken, sorry.
>
> greg k-h
^ permalink raw reply related [flat|nested] 4+ messages in thread