Re: [PATCH] regmap: debugfs: really fix memory leak in regmap_debugfs_init()

[Mark Brown <broonie@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1573 bytes --]

On Tue, Jun 30, 2020 at 12:06:50PM +0200, Juergen Borleis wrote:

>   unreferenced object 0xec548c80 (size 64):
>   comm "swapper/0", pid 1, jiffies 4294937356 (age 3385.690s)
>   hex dump (first 32 bytes):
>     64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72  dummy-iomuxc-gpr
>     40 32 30 65 30 30 30 30 00 7d cc fa 7c df bf 7d  @20e0000.}..|..}
>   backtrace:
>     [<703904e1>] __kmalloc_track_caller+0x1dc/0x43c
>     [<523053d0>] kvasprintf+0x64/0xd8
>     [<0d94bbe5>] kasprintf+0x38/0x5c

Please think hard before including complete backtraces in upstream
reports, they are very large and contain almost no useful information
relative to their size so often obscure the relevant content in your
message. If part of the backtrace is usefully illustrative (it often is
for search engines if nothing else) then it's usually better to pull out
the relevant sections.

> For this specific i.MX device the regmap_debugfs_init() function is called
> twice for the same object:

> - first call: with name = "iomuxc-gpr@20e0000", but the underlying device
>   has no name yet. So, regmap_debugfs_init() allocates the string
>   "dummy-iomuxc-gpr@20e0000" into 'map->debugfs_name' (and this string is
>   the one 'kmemleak' reports in its output).

> - second call: with name = "gpr" and the underlying device now has the
>   name "20e0000.iomuxc". So, regmap_debugfs_init() again allocates
>   a string "20e0000.iomuxc-gpr" into 'map->debugfs_name'.

This sounds like an issue in and of itself - why are we initializing the
same regmap twice without first destroying it?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]