Gh0st
/
linux
mirror of https://github.com/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

s390/mm: Fix memory leak in add_marker() when kvrealloc() fails 

The function has a memory leak when kvrealloc() fails.
The function directly assigns NULL to the markers pointer, losing the
reference to the previously allocated memory. This causes kvfree() in
pt_dump_init() to free NULL instead of the leaked memory.

Fix by:
1. Using kvrealloc() uniformly for all allocations
2. Using a temporary variable to preserve the original pointer until
   allocation succeeds
3. Removing the error path that sets markers_cnt=0 to keep
   consistency between markers and markers_cnt

Found via static analysis and this is similar to commit 42378a9ca5
("bpf, verifier: Fix memory leak in array reallocation for stack state")

Fixes: d0e7915d2a ("s390/mm/ptdump: Generate address marker array dynamically")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
This commit is contained in:
Miaoqian Lin 2025-10-27 23:08:38 +08:00 committed by Heiko Carstens
parent b45873c3f0
commit 07ad45e06b
1 changed files with 7 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
arch/s390/mm/dump_pagetables.c
View File

@ -291,16 +291,14 @@ static int ptdump_cmp(const void *a, const void *b)
static int add_marker(unsigned long start, unsigned long end, const char *name) static int add_marker(unsigned long start, unsigned long end, const char *name)
{ {
size_t oldsize, newsize; struct addr_marker *new;
size_t newsize;
oldsize = markers_cnt * sizeof(*markers); newsize = (markers_cnt + 2) * sizeof(*markers);
newsize = oldsize + 2 * sizeof(*markers); new = kvrealloc(markers, newsize, GFP_KERNEL);
if (!oldsize) if (!new)
markers = kvmalloc(newsize, GFP_KERNEL); return -ENOMEM;
else markers = new;
markers = kvrealloc(markers, newsize, GFP_KERNEL);
if (!markers)
goto error;
markers[markers_cnt].is_start = 1; markers[markers_cnt].is_start = 1;
markers[markers_cnt].start_address = start; markers[markers_cnt].start_address = start;
markers[markers_cnt].size = end - start; markers[markers_cnt].size = end - start;
@ -312,9 +310,6 @@ static int add_marker(unsigned long start, unsigned long end, const char *name)
markers[markers_cnt].name = name; markers[markers_cnt].name = name;
markers_cnt++; markers_cnt++;
return 0; return 0;
error:
markers_cnt = 0;
return -ENOMEM;
} }
static int pt_dump_init(void) static int pt_dump_init(void)