On Wed, Feb 24, 2021 at 03:35:19PM -0700, Dave Jiang wrote:
> Remove devm_* allocation of memory of 'struct device' objects.
> The devm_* lifetime is incompatible with device->release() lifetime.
> Address issues flagged by CONFIG_DEBUG_KOBJECT_RELEASE. Add release
> functions for each component in order to free the allocated memory at
> the appropriate time. Each component such as wq, engine, and group now
> needs to be allocated individually in order to setup the lifetime properly.
You've tested this now with kasn and all the other debugging turned
on?
I poked around a bit and there are other bugs in here too:
static int idxd_wq_cdev_dev_setup(struct idxd_wq *wq)
{
idxd_cdev->dev = kzalloc(sizeof(*idxd_cdev->dev), GFP_KERNEL);
dev_set_name(dev, "%s/wq%u.%u", idxd_get_dev_name(idxd), idxd->id, wq->id);
^^^ Missing error check
if (minor < 0) {
rc = minor;
kfree(dev);
^^^^ leaks the memory dev_set_name allocated
You must call device_initialize before calling dev_set_name and once
device_initialize is called it must do put_device to clean
up. put_device will free memory allocated by dev_set_name
Isn't this a use after free kasn should flag?
device_unregister(idxd_cdev->dev);
ida_simple_remove(&cdev_ctx->minor_ida, idxd_cdev->minor);
^^^^^^
idxd_cdev may
have been freed by device_unregister
Probably a good idea to check all the places working with struct
device carefully to see that they are right
Jason
