From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f172.google.com (mail-pf1-f172.google.com [209.85.210.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85F2733B6E8 for ; Sun, 26 Jul 2026 09:32:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785058333; cv=none; b=HbuEqSoTG/2Xyi/4fi1+VSMXrpX4con+TsKutYsSooSF1NlURrpIq3/LEGKQ8Sl5Kr2SFAxiJhJMYpj9PBWWFDeyDWmfyltJXaM0A0yeTlQ5LckCBkopYJTi4xBqM7pD2Ud7GCqJtvtMLtnt6MygZFfOICqxZNqUGHao1+ZeW2g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785058333; c=relaxed/simple; bh=pOJCn6MRTwenHiqSlXreBDk8qCLUjPSdXPSwsTfuh6g=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=gPiMd+iNr0ZRFY32596v/YaRf9yToyCkCC2AIkIhh+vcQ0hAsdIs4+uBwYMAAYjQawazFI6h4kSaAinupM6/9JujgAejNLZmdO1wzuhlM/2Y3+Z10B55cp7PCUzmPACNR1HJImWegudSgOmj4XMKFNjxxgzEr2Z1zNhUEsreg04= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eTJhepnU; arc=none smtp.client-ip=209.85.210.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eTJhepnU" Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-84e04df8c46so1866390b3a.2 for ; Sun, 26 Jul 2026 02:32:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785058332; x=1785663132; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Vf2nGakrQe4m8ykr6H44BkI8tt373xXT6T7MK0fSYTQ=; b=eTJhepnUTFjvvI15VC+cII6cC78zsHV+M3ywm0NDth75NuLDzFiY7OunJ81oZG887f m3FMXfh4LGbRxcrNnCXeu3Dry91CYijg9R3UIOY18HiEHDUjAXDMbDXdWCU3HBg5/UvR 7nvDEEpbl5JmS06u2xbPyTwF4dYFo2/k9jJtEE0RVw2ToFaX+h/OKSynB8iTJBcsTSxp s4sLdELAp9a2OAyAt1ZEh+HhaZt3G4ctDTimxdVok6Ce35ghp3gDwc4PHVNjEzrXoGPS XyISqwU3HfglG4o3JNBpjXh5xZnwMd2X9UhH7wVdUS2LeeI36XP6TSYdR/LBSMeM/sRf jIIg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785058332; x=1785663132; h=content-transfer-encoding:content-type:mime-version:message-id:date :subject:cc:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Vf2nGakrQe4m8ykr6H44BkI8tt373xXT6T7MK0fSYTQ=; b=L5uXhx/90ObJljPKdyDmRPYQs4VwGg7N5DeWmiYufmQftI+SvhEpQoWxKm0T0q74IG 1MSdXv/rDBgsJxM9e/ftAmQlYT149g5kgpj/I7btrouOHMoRreM1PfRRAUWuYFrVnBHJ snzbVplMUQXj5PyKuYqvXbYP41lRh37iX8Z5vdZWGae2LSqUL8grO/ZNVEFALfBaZkQb tPa8XpAhfxQfqBSb+hvT4OWXMG9MmBB/bV4+2g5Tyfbe54bFvVPpUt+vvosxckjLBu0U K6YTNTHH3j5B6CizKgfpPOULLpdMBKzcj68TitaIMsJ3z+WehBoSkQ4qsFIkolvcYv3m 5tbQ== X-Forwarded-Encrypted: i=1; AHgh+RqmkCta2faf4zC9paptlMxXw6dLMc1enZ6BChRqEytpdJDt6Ng+c5VwrSdqKVpBcsfJd+FTlr0tXCxGEF4=@vger.kernel.org X-Gm-Message-State: AOJu0YxkLdc3QtcGstd9SHy0+gncuprb/j4ltq081+spelC+cYzk6zs6 K9I+sxw3nSP8fQbhf+ghq7l5N0aFHyB9nbvUaO9+WRAFrnHS1mlSfSR0 X-Gm-Gg: AR+sD13LwB1SQJec629A0SaF2jqQ8YosnnlZv9DZpkaA0vtGxACu8WOta7r6q3sdFq5 byBmijPbDd6WJn9naVtchZZDNMuQAjgpSxg8Gp5dU2963GwTPplmWebK8T89KgfgztETOjnA+Zq WWIerCuGrNWoKAYZtBNk9wNzrvHB/ZxnPienIb0riVDaB8+KdTrZx5vlYzgYNGf/ewuW2xllokJ q1A+1mcmkcWr5v1PxuKoEVR/ePAp+TjdIsQlPz/thGZIchahykZz9G/DJKwChxJqANPE1JsUea3 uU9rAxkhzJriBeQvOIdyEWdNtuSz3vqz3N73GKhg3cV1lCp1+/R9tWCfRB5ReUkClQW1eK4tKcb pdCJDro/glT4fSzvcp8IMahvDCrtUZVN4IFI9xzFU9I6j1kGOIDCnFgwKqwLIgLtaJKuP1aLJAp OMRg== X-Received: by 2002:a05:6a00:218f:b0:848:86cf:267b with SMTP id d2e1a72fcca58-84e5959cb48mr3897037b3a.61.1785058331864; Sun, 26 Jul 2026 02:32:11 -0700 (PDT) Received: from ubuntu.. ([2001:2d8:72ac:5ae4:b4c0:11d6:e62a:f791]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84e533d1448sm1731781b3a.30.2026.07.26.02.32.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 26 Jul 2026 02:32:09 -0700 (PDT) From: Rihyeon Kim To: bhelgaas@google.com Cc: linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, tarunsahu@google.com, djeffery@redhat.com, =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= Subject: [PATCH v2 0/2] PCI: Fix dev_set_name() error handling in pci_setup_device() Date: Sun, 26 Jul 2026 18:31:58 +0900 Message-ID: <20260726093200.146111-1-rihyeon8648@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi, pci_setup_device() calls dev_set_name() without checking it. syzbot hits this with fault injection, where it turns into a WARNING and then a NULL pointer dereference. Patch 1 checks the return value and propagates it. Patch 2 is the neighboring leak on the "unknown header type" path, where the name that dev_set_name() allocated is never freed. It was reported by Yang Yingliang in 2022, and Krzysztof suggested picking it up here. I am not sure about the attribution on patch 2, since most of it is Yang Yingliang's fix with the NULL assignment added. If it should look different, or if that patch would be better sent on its own, please let me know and I will respin. This is my first patch to the kernel, so please let me know if I got anything wrong about the form. v1: https://lore.kernel.org/linux-pci/20260725104747.226575-1-rihyeon8648@gmail.com/ v2: - 1/2: Fixes: points at 1fa5ae857bb1 rather than eebfcfb52ce7, since dev_set_name() could not fail before that commit (Krzysztof) - 1/2: update the kernel-doc for the new return value (Krzysztof) - 1/2: say kvasprintf_const() rather than kvasprintf() in the commit log (Krzysztof) - 1/2: pick up Reviewed-by - 2/2: new patch (Krzysztof) Thanks, Rihyeon Rihyeon Kim (2): PCI: Handle dev_set_name() failure in pci_setup_device() PCI: Free the device name on the pci_setup_device() error path drivers/pci/probe.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)