[PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[Gui-Dong Han]

debugfs_write_file_str() uses standard kfree() to release old strings.
Initializing src_node and dst_node with devm_kstrdup() creates a memory
management mismatch. If a user writes to these debugfs nodes, the
devm-allocated memory is freed via kfree(), leaving a dangling pointer
in the device resource list that can lead to a double free.

Fix this by using standard kstrdup() instead. Since the interconnect
subsystem is strictly built-in and cannot be unloaded as a module, there
is no exit path requiring manual cleanup of these strings. The error
handling path is also simplified by taking advantage of the fact that
kfree(NULL) is a safe no-op.

Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
---
I noticed this memory management mismatch while working on similar
debugfs string initialization fixes [1] recently.

[1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/
---
 drivers/interconnect/debugfs-client.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
index 5107bff53173..08df9188ef94 100644
--- a/drivers/interconnect/debugfs-client.c
+++ b/drivers/interconnect/debugfs-client.c
@@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
 		return ret;
 	}
 
-	src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
-	dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
-	if (!src_node || !dst_node)
+	src_node = kstrdup("", GFP_KERNEL);
+	dst_node = kstrdup("", GFP_KERNEL);
+	if (!src_node || !dst_node) {
+		kfree(dst_node);
+		kfree(src_node);
 		return -ENOMEM;
+	}
 
 	client_dir = debugfs_create_dir("test_client", icc_dir);
 
-- 
2.43.0

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[Kuan-Wei Chiu]

On Wed, Mar 18, 2026 at 10:48:15AM +0800, Gui-Dong Han wrote:
> debugfs_write_file_str() uses standard kfree() to release old strings.
> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.
> 
> Fix this by using standard kstrdup() instead. Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings. The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.
> 
> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
> Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>

LGTM. Thanks for the patch.

Reviewed-by: Kuan-Wei Chiu <visitorckw@gmail.com>

Regards,
Kuan-Wei

> ---
> I noticed this memory management mismatch while working on similar
> debugfs string initialization fixes [1] recently.
> 
> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@gmail.com/
> ---
>  drivers/interconnect/debugfs-client.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
> index 5107bff53173..08df9188ef94 100644
> --- a/drivers/interconnect/debugfs-client.c
> +++ b/drivers/interconnect/debugfs-client.c
> @@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
>  		return ret;
>  	}
>  
> -	src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	if (!src_node || !dst_node)
> +	src_node = kstrdup("", GFP_KERNEL);
> +	dst_node = kstrdup("", GFP_KERNEL);
> +	if (!src_node || !dst_node) {
> +		kfree(dst_node);
> +		kfree(src_node);
>  		return -ENOMEM;
> +	}
>  
>  	client_dir = debugfs_create_dir("test_client", icc_dir);
>  
> -- 
> 2.43.0
> 

Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[Markus Elfring]

> debugfs_write_file_str() uses standard kfree() to release old strings.

Why would such information matter here?


> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.

Would an other description approach be clearer for involved dependencies?


> Fix this by using standard kstrdup() instead.

Interesting …

https://elixir.bootlin.com/linux/v7.0-rc4/source/drivers/interconnect/debugfs-client.c#L139-L169


>                                               Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings.

Should string lifetimes be reconsidered for the mentioned function implementation?


>                                                            The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.

I tend to interpret source code simplifications in other directions.


See also once more:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.0-rc4#n34

Regards,
Markus