From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp101.ord1d.emailsrvr.com (smtp101.ord1d.emailsrvr.com [184.106.54.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A05AD361661 for ; Mon, 2 Feb 2026 15:51:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=184.106.54.101 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770047508; cv=none; b=U2DB3AOdvaxyaPSk205gB3C131x+D0/nFPOYSpwNr0XAxHSYvrTUFsRH36rbCgoJIvN0zEP24PMBMckSQZDFzkNYtnIYGwyoRjmDMwDPjgZLdtBmvSTS6L9usAPgB4a1Qq+TN+RcsiaQVnv/nx6XCayqvOK5r2ONMOaN2HORgAI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770047508; c=relaxed/simple; bh=g6bhRiAQiIbnECbxS7RHZ+wcqsF0/zHOOwoCL0t9doM=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=s2CTD0rIskCkGzKu8mshATbXec8Nn1jgYfatT8Ppzxn0EYL3J1v+Rv6KcMzkI3q764nckKi/WtHSp5w5DG7JYT/7f2UqpG2N2/SzacOxgzHq4/m9FgN+f7WBNR0aihN/nYbyDlzQkXO6XqLIvbv1vtqVJjqX15uVq1mQGxYtJCE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk; spf=pass smtp.mailfrom=mev.co.uk; dkim=pass (1024-bit key) header.d=g001.emailsrvr.com header.i=@g001.emailsrvr.com header.b=rEI1i/xa; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b=SBAR6dqe; arc=none smtp.client-ip=184.106.54.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=g001.emailsrvr.com header.i=@g001.emailsrvr.com header.b="rEI1i/xa"; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b="SBAR6dqe" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=g001.emailsrvr.com; s=feedback; t=1770045150; bh=g6bhRiAQiIbnECbxS7RHZ+wcqsF0/zHOOwoCL0t9doM=; h=Date:Subject:From:To:From; b=rEI1i/xaUtL5dw4kCzPrkcE8/NndHm0amLjR30H1hZjdHRrvSDJq52WqbpJVOUO2F By8NeU28zU/ufWVj8K+UweXhJD6NAAGREGgwfLIMnRveUGdDa+7HjxiokqSsKb21Jt PgSGbfnjX+Vdyj8gt860Gpv7pTlS9at/IRgYDNgU= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mev.co.uk; s=20221208-6x11dpa4; t=1770045150; bh=g6bhRiAQiIbnECbxS7RHZ+wcqsF0/zHOOwoCL0t9doM=; h=Date:Subject:From:To:From; b=SBAR6dqeMx2Xqj81MxbqZOoqMxtkko3ebiBLAcbGUrykGOR1qRpKhmItuRfYd3gLY d3soaAzHAc8tcfBZvZ9uMG0lCvolIVg8764Btcwn57p3ZZYMPPga7238v0qWf3cCvY 77QJ1bvjGthF2gMkEFB0aT4H30zN4qg29X3pcuHM= X-Auth-ID: abbotti@mev.co.uk Received: by smtp5.relay.ord1d.emailsrvr.com (Authenticated sender: abbotti-AT-mev.co.uk) with ESMTPSA id 59326A0253; Mon, 2 Feb 2026 10:12:30 -0500 (EST) Message-ID: Date: Mon, 2 Feb 2026 15:12:29 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] comedi: fix device lifecycle handling in comedi_dev_kref_release() From: Ian Abbott To: Salah Triki , H Hartley Sweeten Cc: linux-kernel@vger.kernel.org References: <20260130223517.223996-1-salah.triki@gmail.com> <52bbc0a3-90b4-4330-9487-240a62694ccb@mev.co.uk> Content-Language: en-GB Organization: MEV Ltd. In-Reply-To: <52bbc0a3-90b4-4330-9487-240a62694ccb@mev.co.uk> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Classification-ID: 21b98936-c866-46e7-9baa-3d8b7e8fe2c8-1-1 On 02/02/2026 12:09, Ian Abbott wrote: > On 30/01/2026 22:35, Salah Triki wrote: >> `comedi_dev_kref_release()` calls `put_device()` on `dev->class_dev` and >> then immediately frees the `comedi_device` structure with `kfree()`. >> If the device reference count reaches zero, the device model release >> callback may be invoked, potentially accessing or freeing parts of >> the structure. Calling `kfree()` directly after `put_device()` can >> cause a use-after-free or double-free. >> >> After `device_initialize()` and once the struct device is in the device >> model, all cleanup must go through `put_device()` and the release >> callback. The kref release should not free the structure directly, >> ensuring that `comedi_device` lifetime is properly managed through >> device reference counting and preventing potential memory corruption. >> >> Fixes: 5b13ed94a7d24 ("staging: comedi: add a kref to comedi device") >> >> Signed-off-by: Salah Triki >> --- >>   drivers/comedi/comedi_fops.c | 1 - >>   1 file changed, 1 deletion(-) >> >> diff --git a/drivers/comedi/comedi_fops.c b/drivers/comedi/comedi_fops.c >> index 2c3eb9e89571..24bb06fe6b45 100644 >> --- a/drivers/comedi/comedi_fops.c >> +++ b/drivers/comedi/comedi_fops.c >> @@ -118,7 +118,6 @@ static void comedi_dev_kref_release(struct kref >> *kref) >>       mutex_destroy(&dev->mutex); >>       put_device(dev->class_dev); >> -    kfree(dev); >>   } >>   /** > > NAK > > This isn't freeing the `struct device`, it is freeing the `struct > comedi_device`.  The `struct device` will be freed by > `device_create_release()` in "drivers/base/core.c". To clarify, the call to `put_device()` from `comedi_dev_kref_release()` matches the call to `get_device()` after a successful call to `device_create()` from `comedi_alloc_board_minor()`. The counterpart to `comedi_alloc_board_minor()` is `comedi_free_board_dev()` which calls `device_destroy()` (matching the call to `device_create()`), followed by a call to `comedi_dev_put()`. `comedi_dev_put()` will call `comedi_dev_kref_release()` via `kref_put()` when its reference count reaches zero, and as mentioned previously, its call to `put_device()` matches the previous call to `get_device()` after the device was created. So there are no hooks back to the comedi module code or the `struct comedi_device` at that point because the `struct device` has already been removed from the system. The reason for the extra calls to `get_device()` and `put_device()` is explained by commit 8f988d8784e3 ("staging/comedi: keep reference to class device after destroyed"). -- -=( Ian Abbott || MEV Ltd. is a company )=- -=( registered in England & Wales. Regd. number: 02862268. )=- -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-