[PATCH v2 1/2] driver core: faux: fix root device registration

[PATCH v2 1/2] driver core: faux: fix root device registration

[Johan Hovold]

A recent change made the faux bus root device be allocated dynamically
but failed to provide a release function to free the memory when the
last reference is dropped (on theoretical failure to register the device
or bus).

Fix this by using root_device_register() instead of open coding.

Also add the missing sanity check when registering faux devices to avoid
use-after-free if the bus failed to register (which would previously
have triggered a bunch of use-after-free warnings).

Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
Cc: stable@vger.kernel.org	# 7.0
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/base/faux.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/drivers/base/faux.c b/drivers/base/faux.c
index fb3e42f21362..3d1d1eafb473 100644
--- a/drivers/base/faux.c
+++ b/drivers/base/faux.c
@@ -133,6 +133,9 @@ struct faux_device *faux_device_create_with_groups(const char *name,
 	struct device *dev;
 	int ret;
 
+	if (!faux_bus_root)
+		return NULL;
+
 	faux_obj = kzalloc_obj(*faux_obj);
 	if (!faux_obj)
 		return NULL;
@@ -232,19 +235,12 @@ EXPORT_SYMBOL_GPL(faux_device_destroy);
 
 int __init faux_bus_init(void)
 {
+	struct device *root;
 	int ret;
 
-	faux_bus_root = kzalloc_obj(*faux_bus_root);
-	if (!faux_bus_root)
-		return -ENOMEM;
-
-	dev_set_name(faux_bus_root, "faux");
-
-	ret = device_register(faux_bus_root);
-	if (ret) {
-		put_device(faux_bus_root);
-		return ret;
-	}
+	root = root_device_register("faux");
+	if (IS_ERR(root))
+		return PTR_ERR(root);
 
 	ret = bus_register(&faux_bus_type);
 	if (ret)
@@ -254,12 +250,14 @@ int __init faux_bus_init(void)
 	if (ret)
 		goto error_driver;
 
+	faux_bus_root = root;
+
 	return ret;
 
 error_driver:
 	bus_unregister(&faux_bus_type);
 
 error_bus:
-	device_unregister(faux_bus_root);
+	root_device_unregister(root);
 	return ret;
 }
-- 
2.53.0

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Danilo Krummrich]

On Fri Apr 24, 2026 at 5:31 PM CEST, Johan Hovold wrote:
> A recent change made the faux bus root device be allocated dynamically
> but failed to provide a release function to free the memory when the
> last reference is dropped (on theoretical failure to register the device
> or bus).
>
> Fix this by using root_device_register() instead of open coding.
>
> Also add the missing sanity check when registering faux devices to avoid
> use-after-free if the bus failed to register (which would previously
> have triggered a bunch of use-after-free warnings).
>
> Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
> Cc: stable@vger.kernel.org	# 7.0

I think this is more of a theoretical issue, do we need this in stable trees?

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Johan Hovold]

On Wed, Apr 29, 2026 at 12:19:06AM +0200, Danilo Krummrich wrote:
> On Fri Apr 24, 2026 at 5:31 PM CEST, Johan Hovold wrote:
> > A recent change made the faux bus root device be allocated dynamically
> > but failed to provide a release function to free the memory when the
> > last reference is dropped (on theoretical failure to register the device
> > or bus).
> >
> > Fix this by using root_device_register() instead of open coding.
> >
> > Also add the missing sanity check when registering faux devices to avoid
> > use-after-free if the bus failed to register (which would previously
> > have triggered a bunch of use-after-free warnings).
> >
> > Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
> > Cc: stable@vger.kernel.org	# 7.0
> 
> I think this is more of a theoretical issue, do we need this in stable trees?

Sure, this is borderline, but given that autosel would probably pick it
up anyway we might as well mark it directly.

Johan

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Danilo Krummrich]

On Wed Apr 29, 2026 at 12:17 PM CEST, Johan Hovold wrote:
> On Wed, Apr 29, 2026 at 12:19:06AM +0200, Danilo Krummrich wrote:
>> On Fri Apr 24, 2026 at 5:31 PM CEST, Johan Hovold wrote:
>> > A recent change made the faux bus root device be allocated dynamically
>> > but failed to provide a release function to free the memory when the
>> > last reference is dropped (on theoretical failure to register the device
>> > or bus).
>> >
>> > Fix this by using root_device_register() instead of open coding.
>> >
>> > Also add the missing sanity check when registering faux devices to avoid
>> > use-after-free if the bus failed to register (which would previously
>> > have triggered a bunch of use-after-free warnings).
>> >
>> > Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
>> > Cc: stable@vger.kernel.org	# 7.0
>> 
>> I think this is more of a theoretical issue, do we need this in stable trees?
>
> Sure, this is borderline, but given that autosel would probably pick it
> up anyway we might as well mark it directly.

In such a case developers should probably give the stable team a hint that the
patch in question does not need backporting.

But using the expectation that autosel may pick it up as a justification to mark
it for stable in the first place seems wrong.

The stable documentation [1] is very clear that theoretical issues must not be
backported into stable trees unless an explanation of how the bug can be
exploited can be provided.

If that was relaxed in some way, it probably needs updating.

[1] https://docs.kernel.org/process/stable-kernel-rules.html#everything-you-ever-wanted-to-know-about-linux-stable-releases

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Johan Hovold]

On Wed, Apr 29, 2026 at 12:47:53PM +0200, Danilo Krummrich wrote:
> On Wed Apr 29, 2026 at 12:17 PM CEST, Johan Hovold wrote:
> > On Wed, Apr 29, 2026 at 12:19:06AM +0200, Danilo Krummrich wrote:
> >> On Fri Apr 24, 2026 at 5:31 PM CEST, Johan Hovold wrote:
> >> > A recent change made the faux bus root device be allocated dynamically
> >> > but failed to provide a release function to free the memory when the
> >> > last reference is dropped (on theoretical failure to register the device
> >> > or bus).
> >> >
> >> > Fix this by using root_device_register() instead of open coding.
> >> >
> >> > Also add the missing sanity check when registering faux devices to avoid
> >> > use-after-free if the bus failed to register (which would previously
> >> > have triggered a bunch of use-after-free warnings).
> >> >
> >> > Fixes: 61b76d07d2b4 ("driver core: faux: stop using static struct device")
> >> > Cc: stable@vger.kernel.org	# 7.0
> >> 
> >> I think this is more of a theoretical issue, do we need this in stable trees?
> >
> > Sure, this is borderline, but given that autosel would probably pick it
> > up anyway we might as well mark it directly.
> 
> In such a case developers should probably give the stable team a hint that the
> patch in question does not need backporting.
> 
> But using the expectation that autosel may pick it up as a justification to mark
> it for stable in the first place seems wrong.

It fixes a memory leak (and some warnings). We backport such fixes all
the time, including in other error paths which are unlikely to ever be
hit.

> The stable documentation [1] is very clear that theoretical issues must not be
> backported into stable trees unless an explanation of how the bug can be
> exploited can be provided.
> 
> If that was relaxed in some way, it probably needs updating.

The stable rules have been relaxed in practice since Autosel. Anything
that looks like a fix (e.g. has a Fixes tag) gets backported.

And people get tired of asking the stable team to drop patches that were
not marked for backporting.

But feel free to drop the CC-stable tag here if you want to.

Johan

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Danilo Krummrich]

On Wed Apr 29, 2026 at 1:19 PM CEST, Johan Hovold wrote:
> The stable rules have been relaxed in practice since Autosel. Anything
> that looks like a fix (e.g. has a Fixes tag) gets backported.
>
> And people get tired of asking the stable team to drop patches that were
> not marked for backporting.

There is still a difference between this happening in practice and using that as
a justification to explicitly request a stable backport for something that - by
the official rules - isn't mandated for stable backport.

If the rules changed to the point that they don't apply anymore for deciding
whether to stick Cc: stable on a patch or not, then they should be adjusted
accordingly.

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Johan Hovold]

On Wed, Apr 29, 2026 at 04:20:18PM +0200, Danilo Krummrich wrote:
> On Wed Apr 29, 2026 at 1:19 PM CEST, Johan Hovold wrote:
> > The stable rules have been relaxed in practice since Autosel. Anything
> > that looks like a fix (e.g. has a Fixes tag) gets backported.
> >
> > And people get tired of asking the stable team to drop patches that were
> > not marked for backporting.
> 
> There is still a difference between this happening in practice and using that as
> a justification to explicitly request a stable backport for something that - by
> the official rules - isn't mandated for stable backport.

Again, feel free to drop the CC stable tag if you want to.

Johan

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Danilo Krummrich]

On Wed Apr 29, 2026 at 5:02 PM CEST, Johan Hovold wrote:
> Again, feel free to drop the CC stable tag if you want to.

It's not so much about what I want -- I just try to stay close to what the
guideline is, and only deviate when there's a good reason.

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Greg Kroah-Hartman]

On Wed, Apr 29, 2026 at 10:11:31PM +0200, Danilo Krummrich wrote:
> On Wed Apr 29, 2026 at 5:02 PM CEST, Johan Hovold wrote:
> > Again, feel free to drop the CC stable tag if you want to.
> 
> It's not so much about what I want -- I just try to stay close to what the
> guideline is, and only deviate when there's a good reason.
> 

Personally, I think it's good to backport this.  I trust Johan here so I
have no objection to taking this for stable trees (nor the other patches
he tagged for stable).

The rules are there for the stable maintainers to say "no" to, not so
much for us to be extremely strict about it at times if it makes sense
to us.

thanks,

greg k-h

Re: [PATCH v2 1/2] driver core: faux: fix root device registration

[Danilo Krummrich]

On Thu Apr 30, 2026 at 9:00 AM CEST, Greg Kroah-Hartman wrote:
> On Wed, Apr 29, 2026 at 10:11:31PM +0200, Danilo Krummrich wrote:
>> It's not so much about what I want -- I just try to stay close to what the
>> guideline is, and only deviate when there's a good reason.
>> 
>
> Personally, I think it's good to backport this.

That's good to know, I personally also lean more towards backporting such
things. But for the above reason, I did abstain from it so far, unless I could
really make a strong case.

> The rules are there for the stable maintainers to say "no" to, not so
> much for us to be extremely strict about it at times if it makes sense
> to us.

Thanks for clarifying!

Generally speaking, I don't think this is about being extremely strict about it;
the stable documentation itself is rather strictly worded I think.

I wonder if we can improve the wording without giving up on the "stable
maintainers reserve their right to say no" part to better reflect this.