On Wed, Feb 24, 2021 at 03:35:19PM -0700, Dave Jiang wrote:

Remove devm_* allocation of memory of 'struct device' objects.
The devm_* lifetime is incompatible with device->release() lifetime.
Address issues flagged by CONFIG_DEBUG_KOBJECT_RELEASE. Add release
functions for each component in order to free the allocated memory at
the appropriate time. Each component such as wq, engine, and group now
needs to be allocated individually in order to setup the lifetime properly.

You've tested this now with kasn and all the other debugging turned
on?

I poked around a bit and there are other bugs in here too:

static int idxd_wq_cdev_dev_setup(struct idxd_wq *wq)
{
        idxd_cdev->dev = kzalloc(sizeof(*idxd_cdev->dev), GFP_KERNEL);
        dev_set_name(dev, "%s/wq%u.%u", idxd_get_dev_name(idxd), idxd->id, wq->id);
        ^^^ Missing error check

        if (minor < 0) {
                rc = minor;
                kfree(dev);
                ^^^^ leaks the memory dev_set_name allocated

You must call device_initialize before calling dev_set_name and once
device_initialize is called it must do put_device to clean
up. put_device will free memory allocated by dev_set_name

Isn't this a use after free kasn should flag?

        device_unregister(idxd_cdev->dev);
        ida_simple_remove(&cdev_ctx->minor_ida, idxd_cdev->minor);
                                                ^^^^^^
                                             idxd_cdev may
					have been freed by device_unregister

Probably a good idea to check all the places working with struct
device carefully to see that they are right

Jason