Why is devm_kzalloc() harmful and what can we do about it
summary
Argument: devm_kzalloc ties memory to the physical struct device, so unplugging or unbinding frees resources while user processes still hold file descriptors, creating real use-after-free crashes. Evidence: long-standing conversions across kernels and subsystems, DRM uses a separate drmm_kzalloc that ties allocations to the char-device lifetime and avoids the bug. Proposed fixes: add a separate device-owner lifetime object, propagate krefs automatically, or add compiler/tooling checks and clear examples; prototypes exist in DRM and V4L but full generic solution is unfinished.
AI-written summary · about
chapters (6)
- 0:00Introduction to devres
- 10:20The use-after-free problem
- 18:09Current devres limitations
- 26:10Solutions and trade-offs
- 36:43Tooling and future work
- 42:42Q&A and closing
related talks
47mSubsystems with Object Lifetime Issues (in the Embedded Case)
40mBoF: Object Life-Time Handling in Driver Subsystems
41mObject Lifetime Issues - a Threat for Safety?
53mImproving resource ownership and life-time in linux device drivers
35mDMA Safety in Buffers for Linux Kernel Device Drivers
23mDealing with Uninitialized Memory in the Kernel
39mThe Power of the Device Mapper - From Dm-cache To Dm-zoned
39mTaming DMA: Tales Wrestling Memory Corruption