Re: [PATCH] interconnect: debugfs: fix devm_kstrdup and kfree mismatch

[Gui-Dong Han]

On Wed, Mar 18, 2026 at 10:48 AM Gui-Dong Han <hanguidong02@xxxxxxxxx> wrote:
>
> debugfs_write_file_str() uses standard kfree() to release old strings.
> Initializing src_node and dst_node with devm_kstrdup() creates a memory
> management mismatch. If a user writes to these debugfs nodes, the
> devm-allocated memory is freed via kfree(), leaving a dangling pointer
> in the device resource list that can lead to a double free.
>
> Fix this by using standard kstrdup() instead. Since the interconnect
> subsystem is strictly built-in and cannot be unloaded as a module, there
> is no exit path requiring manual cleanup of these strings. The error
> handling path is also simplified by taking advantage of the fact that
> kfree(NULL) is a safe no-op.
>
> Fixes: 8cc27f5c6dd1 ("interconnect: debugfs: initialize src_node and dst_node to empty strings")
> Signed-off-by: Gui-Dong Han <hanguidong02@xxxxxxxxx>
> ---
> I noticed this memory management mismatch while working on similar
> debugfs string initialization fixes [1] recently.
>
> [1] https://lore.kernel.org/driver-core/20260317185920.43387-1-hanguidong02@xxxxxxxxx/

Hello Georgi,

Gentle ping on this patch.

Just wanted to note that my other related fix has already been accepted [1].

Could you please let me know if this fell through the cracks, or if
you have any feedback or modification requests? I'd be very happy to
address them.

Thanks.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core.git/commit/?h=driver-core-testing&id=31de83980d37

> ---
>  drivers/interconnect/debugfs-client.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/interconnect/debugfs-client.c b/drivers/interconnect/debugfs-client.c
> index 5107bff53173..08df9188ef94 100644
> --- a/drivers/interconnect/debugfs-client.c
> +++ b/drivers/interconnect/debugfs-client.c
> @@ -150,10 +150,13 @@ int icc_debugfs_client_init(struct dentry *icc_dir)
>                 return ret;
>         }
>
> -       src_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -       dst_node = devm_kstrdup(&pdev->dev, "", GFP_KERNEL);
> -       if (!src_node || !dst_node)
> +       src_node = kstrdup("", GFP_KERNEL);
> +       dst_node = kstrdup("", GFP_KERNEL);
> +       if (!src_node || !dst_node) {
> +               kfree(dst_node);
> +               kfree(src_node);
>                 return -ENOMEM;
> +       }
>
>         client_dir = debugfs_create_dir("test_client", icc_dir);
>
> --
> 2.43.0
>