On Wed, Feb 10, 2021 at 10:05:29PM +0300, Dan Carpenter wrote:

On Wed, Feb 10, 2021 at 07:39:16PM +0100, Geert Uytterhoeven wrote:

quoted

Hi Dan,

On Wed, Feb 10, 2021 at 7:21 PM Dan Carpenter [off-list ref] wrote:

quoted

99b2f99aa41aa7 Drew Fustini  2021-02-09  694    buf = devm_kzalloc(pctldev->dev, PINMUX_MAX_NAME * 2, GFP_KERNEL);
99b2f99aa41aa7 Drew Fustini  2021-02-09  695    if (!buf)
99b2f99aa41aa7 Drew Fustini  2021-02-09  696            return -ENOMEM;
99b2f99aa41aa7 Drew Fustini  2021-02-09  697
99b2f99aa41aa7 Drew Fustini  2021-02-09  698    fname = devm_kzalloc(pctldev->dev, PINMUX_MAX_NAME, GFP_KERNEL);
99b2f99aa41aa7 Drew Fustini  2021-02-09  699    if (!fname) {
99b2f99aa41aa7 Drew Fustini  2021-02-09  700            ret = -ENOMEM;
99b2f99aa41aa7 Drew Fustini  2021-02-09  701            goto free_buf;

The gotos are out of order.  They should be in mirror/reverse order of
the allocations:

free_gmane:
        devm_kfree(pctldev->dev, gname);
free_fname:
        devm_kfree(pctldev->dev, fname);
free_buf:
        devm_kfree(pctldev->dev, buf);

But also why do we need to use devm_kfree() at all?  I thought the whole
point of devm_ functions was that they are garbage collected
automatically for you.  Can we not just delete all error handling and
return -ENOMEM here?

No, because the lifetime of the objects allocated here does not match the
lifetime of dev.  If they're not freed here, they will only be freed when the
device is unbound.  As the user can access the sysfs files at will, he can
OOM the system.

Then why not use vanilla kmalloc()?

Yes, I believe that is the correct approach.  The problem was due to my
misunderstanding of when devm_*() was appropriate.  In this case, I
should have been using the vanilla allocation as the buffers used in
this debugfs write operation are not tied to the lifetime of the pin
controller device.  The are just allocated for internal use inside the
write function.

thanks,
drew