From nobody Sun Dec 28 21:22:33 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE97BC4167B for ; Tue, 5 Dec 2023 03:37:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344222AbjLEDhj (ORCPT ); Mon, 4 Dec 2023 22:37:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36630 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231624AbjLEDhi (ORCPT ); Mon, 4 Dec 2023 22:37:38 -0500 X-Greylist: delayed 71681 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 04 Dec 2023 19:37:41 PST Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [20.231.56.155]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 6AC95B4 for ; Mon, 4 Dec 2023 19:37:41 -0800 (PST) Received: from localhost.localdomain (unknown [10.190.70.5]) by mail-app2 (Coremail) with SMTP id by_KCgBHvdS4mG5l3TBKAA--.35678S4; Tue, 05 Dec 2023 11:28:00 +0800 (CST) From: Dinghao Liu To: dinghao.liu@zju.edu.cn Cc: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Mark Rutland , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Ian Rogers , Adrian Hunter , Thomas Gleixner , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Colin Ian King , linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] perf/x86/uncore: fix a potential double-free in uncore_type_init Date: Tue, 5 Dec 2023 11:27:09 +0800 Message-Id: <20231205032709.9525-1-dinghao.liu@zju.edu.cn> X-Mailer: git-send-email 2.17.1 X-CM-TRANSID: by_KCgBHvdS4mG5l3TBKAA--.35678S4 X-Coremail-Antispam: 1UD129KBjvdXoW7JFWfGr13Aw17Aw47AryrJFb_yoWkArX_WF 1UJaykJr4Ska95W348AFW5Grn7Kw48Z3yrGr1FqF4kAry5tF1DCFs7Gr9ayw4xWrWDZFW8 ArZxKr1jvw18AjkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbskFc2x0x2IEx4CE42xK8VAvwI8IcIk0rVWrJVCq3wAFIxvE14AK wVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK021l84ACjcxK6xIIjxv20x vE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4UJVW0owA2z4x0Y4vEx4A2 jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS0I0E0xvYzxvE52 x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AKxVWUJVWU GwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48IcxkI7VAKI4 8JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2xKxwCF04k20xvY 0x0EwIxGrwCF04k20xvE74AGY7Cv6cx26r4fKr1UJr1l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr 1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE 14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7 IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E 87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73Uj IFyTuYvjfUoOJ5UUUUU X-CM-SenderInfo: qrrzjiaqtzq6lmxovvfxof0/1tbiAgoTBmVsUQg4xgAMs- Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" When kzalloc for pmus[i].boxes fails, we should clean up pmus to prevent memleak. However, when kzalloc for attr_group fails, pmus has been assigned to type->pmus, and freeing will be done later on by the callers. The chain is: uncore_type_init -> uncore_types_init -> uncore_pci_init -> uncore_types_exit -> uncore_type_exit. Therefore, freeing pmus in uncore_type_init may cause a double-free. Fix this by setting type->pmus to NULL after kfree. Fixes: 629eb703d3e4 ("perf/x86/intel/uncore: Fix memory leaks on allocation= failures") Signed-off-by: Dinghao Liu Reviewed-by: Adrian Hunter Reviewed-by: Zhenyu Wang --- arch/x86/events/intel/uncore.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c index 01023aa5125b..d80445a24011 100644 --- a/arch/x86/events/intel/uncore.c +++ b/arch/x86/events/intel/uncore.c @@ -1041,6 +1041,7 @@ static int __init uncore_type_init(struct intel_uncor= e_type *type, bool setid) for (i =3D 0; i < type->num_boxes; i++) kfree(pmus[i].boxes); kfree(pmus); + type->pmus =3D NULL; =20 return -ENOMEM; } --=20 2.17.1