sched_init_numa() publishes sched_domains_numa_masks before it
allocates the topology array.  When that allocation fails, the early
return leaves the masks published while sched_domains_numa_levels is
still zero: nothing dereferences them, but nothing can free them
either, and the topology they were built for is never installed.
Unpublish and free them instead.

Fixes: cb83b629bae0 ("sched/numa: Rewrite the CONFIG_NUMA sched domain support")
Signed-off-by: Fengyu Wang <wangfengyu@hygon.cn>
---
Tested by hardcoding tl to NULL right after the kzalloc() to force the
failure path; the masks are released and the machine boots normally.

 kernel/sched/topology.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 622e2e01974c..208fdc52f52d 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -2403,8 +2403,17 @@ void sched_init_numa(int offline_node)
 
 	tl = kzalloc((i + nr_levels + 1) *
 			sizeof(struct sched_domain_topology_level), GFP_KERNEL);
-	if (!tl)
+	if (!tl) {
+		rcu_assign_pointer(sched_domains_numa_masks, NULL);
+		synchronize_rcu();
+		for (i = 0; i < nr_levels; i++) {
+			for_each_node(j)
+				kfree(masks[i][j]);
+			kfree(masks[i]);
+		}
+		kfree(masks);
 		return;
+	}
 
 	/*
 	 * Copy the default topology bits..
-- 
2.34.1

On Fri, 2026-07-31 at 16:14 +0800, Fengyu Wang wrote:
> sched_init_numa() publishes sched_domains_numa_masks before it
> allocates the topology array.  When that allocation fails, the early
> return leaves the masks published while sched_domains_numa_levels is
> still zero: nothing dereferences them, but nothing can free them
> either, and the topology they were built for is never installed.
> Unpublish and free them instead.
> 
> Fixes: cb83b629bae0 ("sched/numa: Rewrite the CONFIG_NUMA sched domain support")
> Signed-off-by: Fengyu Wang <wangfengyu@hygon.cn>
> ---
> Tested by hardcoding tl to NULL right after the kzalloc() to force the
> failure path; the masks are released and the machine boots normally.
> 
>  kernel/sched/topology.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
> index 622e2e01974c..208fdc52f52d 100644
> --- a/kernel/sched/topology.c
> +++ b/kernel/sched/topology.c
> @@ -2403,8 +2403,17 @@ void sched_init_numa(int offline_node)
>  
>  	tl = kzalloc((i + nr_levels + 1) *
>  			sizeof(struct sched_domain_topology_level), GFP_KERNEL);
> -	if (!tl)
> +	if (!tl) {
> +		rcu_assign_pointer(sched_domains_numa_masks, NULL);
> +		synchronize_rcu();
> +		for (i = 0; i < nr_levels; i++) {
> +			for_each_node(j)
> +				kfree(masks[i][j]);
> +			kfree(masks[i]);
> +		}
> +		kfree(masks);
>  		return;
> +	}

The code is cleaner without the synchronize_rcu() and set to null dance if we do
rcu_assign_pointer(sched_domains_numa_masks, masks);
after the tl check.

Thanks.

Tim

>  
>  	/*
>  	 * Copy the default topology bits..

Agreed, that's simpler.  V2 will move the rcu_assign_pointer() below the tl check.

Thanks.
Fengyu Wang 
 
-----邮件原件-----
发件人: Tim Chen <tim.c.chen@linux.intel.com> 
发送时间: 2026年8月4日 9:15
收件人: Fengyu Wang <wangfengyu@hygon.cn>; Ingo Molnar <mingo@redhat.com>; Peter Zijlstra <peterz@infradead.org>; Juri Lelli <juri.lelli@redhat.com>; Vincent Guittot <vincent.guittot@linaro.org>
抄送: Dietmar Eggemann <dietmar.eggemann@arm.com>; Steven Rostedt <rostedt@goodmis.org>; Ben Segall <bsegall@google.com>; Mel Gorman <mgorman@suse.de>; Valentin Schneider <vschneid@redhat.com>; K Prateek Nayak <kprateek.nayak@amd.com>; Chen Yu <yu.c.chen@intel.com>; Shrikanth Hegde <sshegde@linux.ibm.com>; linux-kernel@vger.kernel.org; Jianyong Wu <wujianyong@hygon.cn>; Yuan Zhong <zhongyuan@hygon.cn>; Huangsj <huangsj@hygon.cn>
主题: Re: [PATCH] sched/topology: Free NUMA masks on topology allocation failure

On Fri, 2026-07-31 at 16:14 +0800, Fengyu Wang wrote:
> sched_init_numa() publishes sched_domains_numa_masks before it 
> allocates the topology array.  When that allocation fails, the early 
> return leaves the masks published while sched_domains_numa_levels is 
> still zero: nothing dereferences them, but nothing can free them 
> either, and the topology they were built for is never installed.
> Unpublish and free them instead.
> 
> Fixes: cb83b629bae0 ("sched/numa: Rewrite the CONFIG_NUMA sched domain 
> support")
> Signed-off-by: Fengyu Wang <wangfengyu@hygon.cn>
> ---
> Tested by hardcoding tl to NULL right after the kzalloc() to force the 
> failure path; the masks are released and the machine boots normally.
> 
>  kernel/sched/topology.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 
> 622e2e01974c..208fdc52f52d 100644
> --- a/kernel/sched/topology.c
> +++ b/kernel/sched/topology.c
> @@ -2403,8 +2403,17 @@ void sched_init_numa(int offline_node)
>  
>  	tl = kzalloc((i + nr_levels + 1) *
>  			sizeof(struct sched_domain_topology_level), GFP_KERNEL);
> -	if (!tl)
> +	if (!tl) {
> +		rcu_assign_pointer(sched_domains_numa_masks, NULL);
> +		synchronize_rcu();
> +		for (i = 0; i < nr_levels; i++) {
> +			for_each_node(j)
> +				kfree(masks[i][j]);
> +			kfree(masks[i]);
> +		}
> +		kfree(masks);
>  		return;
> +	}

The code is cleaner without the synchronize_rcu() and set to null dance if we do rcu_assign_pointer(sched_domains_numa_masks, masks); after the tl check.

Thanks.

Tim

>  
>  	/*
>  	 * Copy the default topology bits..