mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 03:11:11 -04:00
Code Issues Packages Projects Releases Wiki Activity

mm/mempolicy: fix memory leaks in weighted_interleave_auto_store()

Browse Source 
weighted_interleave_auto_store() fetches old_wi_state inside the if
(!input) block only.  This causes two memory leaks:

1. When a user writes "false" and the current mode is already manual,
   the function returns early without freeing the freshly allocated
   new_wi_state.

2. When a user writes "true", old_wi_state stays NULL because the
   fetch is skipped entirely. The old state is then overwritten by
   rcu_assign_pointer() but never freed, since the cleanup path is
   gated on old_wi_state being non-NULL. A user can trigger this
   repeatedly by writing "1" in a loop.

Fix both leaks by moving the old_wi_state fetch before the input check,
making it unconditional.  This also allows a unified early return for both
"true" and "false" when the requested mode matches the current mode.

Link: https://lore.kernel.org/20260401005702.7096-1-liu.yun@linux.dev
Link: https://sashiko.dev/#/patchset/20260331100740.84906-1-liu.yun@linux.dev
Fixes: e341f9c3c8 ("mm/mempolicy: Weighted Interleave Auto-tuning")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed by: Donet Tom <donettom@linux.ibm.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: <stable@vger.kernel.org> # v6.16+
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Jackie Liu
2026-04-01 08:57:02 +08:00
committed by Andrew Morton
parent 0c13ed77dd
commit 6fae274ce0
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
mm/mempolicy.c
View File

@@ -3700,18 +3700,19 @@ static ssize_t weighted_interleave_auto_store(struct kobject *kobj,
new_wi_state->iw_table[i] = 1;
mutex_lock(&wi_state_lock);
if (!input) {
old_wi_state = rcu_dereference_protected(wi_state,
lockdep_is_held(&wi_state_lock));
if (!old_wi_state)
goto update_wi_state;
if (input == old_wi_state->mode_auto) {
mutex_unlock(&wi_state_lock);
return count;
}
old_wi_state = rcu_dereference_protected(wi_state,
lockdep_is_held(&wi_state_lock));
memcpy(new_wi_state->iw_table, old_wi_state->iw_table,
nr_node_ids * sizeof(u8));
if (old_wi_state && input == old_wi_state->mode_auto) {
mutex_unlock(&wi_state_lock);
kfree(new_wi_state);
return count;
}
if (!input) {
if (old_wi_state)
memcpy(new_wi_state->iw_table, old_wi_state->iw_table,
nr_node_ids * sizeof(u8));
goto update_wi_state;
}