Subsystems with Object Lifetime Issues (in the Embedded Case)
summary
Claim: embedding a struct device inside driver-private structs and allocating the wrapper with devm_kzalloc always wrong in this context lets a platform remove free an object while it still has refs, producing use-after-free or hangs. A Coccinelle scan found ~630 structs that can embed struct device and produced a handful of real hits; demos include an MTD crash reproducer and a UART case that blocks via wait-for-completion. Fixes: subsystem-owned alloc APIs, release-hook audits, Coccinelle checks and exploring __cleanup/refcount patterns.
AI-written summary · about
chapters (22)
- 0:00Object lifetime issues intro
- 1:50Device reference counting basics
- 3:14Lifetime problems rarity and danger
- 5:39Managed vs manual allocation
- 6:21devm_kzalloc trap in drivers
- 8:28Research with Coccinelle
- 11:59First results and surprises
- 12:44Live demo: UART behavior
- 15:24Live demo: MTD crash
- 18:40Live demo: I²C protection
- 23:18Analysis of I3C and NTV
- 24:44VirtIO subsystem investigation
- 26:36VirtIO devres misuse and fix
- 31:34Auxiliary bus API risks
- 33:21Preferred device lifetime solution
- 37:37USB gadget findings
- 38:18Lifecycle problems summary
- 40:02Solutions and future research
- 42:29Safety audits and process challenges
- 43:54Future outlook and fixes
- 44:38Acknowledgments
- 45:20Q&A: Devres and refcounted objects
related talks
53mImproving resource ownership and life-time in linux device drivers
41mObject Lifetime Issues - a Threat for Safety?
40mBoF: Object Life-Time Handling in Driver Subsystems
44mWhy is devm_kzalloc() harmful and what can we do about it
44mHands Off and Putting SLAB/SLUB Feng Shui in a Blackbox
36mRISC-V Bug Hunting
45mBOF: Corporate Use of Embedded Linux
24mNew Compat Vulnerabilities in Linux Device Drivers