Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[Kuan-Wei Chiu]

On Wed, Mar 18, 2026 at 10:48:15AM +0800, Gui-Dong Han wrote:
> debugfs_write_file_str() uses standard kfree() to release old strings.
> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.
> 
> Fix this by using standard kstrdup() instead. Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings. The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.
> 
> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
> Signed-off-by: Gui-Dong Han <hanguidong02@xxxxxxxxx>

LGTM. Thanks for the patch.

Reviewed-by: Kuan-Wei Chiu <visitorckw@xxxxxxxxx>

Regards,
Kuan-Wei

> ---
> I noticed this memory management mismatch while working on similar
> debugfs string initialization fixes [1] recently.
> 
> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@xxxxxxxxx/
> ---
>  drivers/interconnect/debugfs-client.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
> index 5107bff53173..08df9188ef94 100644
> --- a/drivers/interconnect/debugfs-client.c
> +++ b/drivers/interconnect/debugfs-client.c
> @@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
>  		return ret;
>  	}
>  
> -	src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -	if (!src_node || !dst_node)
> +	src_node = kstrdup("", GFP_KERNEL);
> +	dst_node = kstrdup("", GFP_KERNEL);
> +	if (!src_node || !dst_node) {
> +		kfree(dst_node);
> +		kfree(src_node);
>  		return -ENOMEM;
> +	}
>  
>  	client_dir = debugfs_create_dir("test_client", icc_dir);
>  
> -- 
> 2.43.0
>