[PATCH v2 0/2] PCI: Fix dev_set_name() error handling in pci_setup_device()

[Rihyeon Kim <rihyeon8648@gmail.com>]

Hi,

pci_setup_device() calls dev_set_name() without checking it.  syzbot hits
this with fault injection, where it turns into a WARNING and then a NULL
pointer dereference.  Patch 1 checks the return value and propagates it.

Patch 2 is the neighboring leak on the "unknown header type" path, where
the name that dev_set_name() allocated is never freed.  It was reported by
Yang Yingliang in 2022, and Krzysztof suggested picking it up here.

I am not sure about the attribution on patch 2, since most of it is Yang
Yingliang's fix with the NULL assignment added.  If it should look
different, or if that patch would be better sent on its own, please let me
know and I will respin.

This is my first patch to the kernel, so please let me know if I got
anything wrong about the form.

v1: https://lore.kernel.org/linux-pci/20260725104747.226575-1-rihyeon8648@gmail.com/

v2:
 - 1/2: Fixes: points at 1fa5ae857bb1 rather than eebfcfb52ce7, since
   dev_set_name() could not fail before that commit (Krzysztof)
 - 1/2: update the kernel-doc for the new return value (Krzysztof)
 - 1/2: say kvasprintf_const() rather than kvasprintf() in the commit log
   (Krzysztof)
 - 1/2: pick up Reviewed-by
 - 2/2: new patch (Krzysztof)

Thanks,
Rihyeon

Rihyeon Kim (2):
  PCI: Handle dev_set_name() failure in pci_setup_device()
  PCI: Free the device name on the pci_setup_device() error path

 drivers/pci/probe.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)