superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

arm_mpam: Check whether the config array is allocated before destroying it 

__destroy_component_cfg() is called to free the configuration array.
It uses the embedded 'garbage' structure, which means the array has
to be allocated.

If __destroy_component_cfg() is called from mpam_disable() before the
configuration was ever allocated, then a NULL pointer is dereferenced.

Check for this case and return early if the configuration is not
allocated.

__destroy_component_cfg() also frees the mbwu_state as this is allocated
by __allocate_component_cfg(). As the mbwu_state is allocated after
comp->cfg is set, and is also under mpam_list_lock, only the first
pointer needs checking.

Fixes: 3bd04fe7d8 ("arm_mpam: Extend reset logic to allow devices to be reset any time")
Cc: <stable@vger.kernel.org>
Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by: Ben Horgan <ben.horgan@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
master
James Morse 2026-05-08 17:23:39 +01:00 committed by Catalin Marinas
parent f1caff3335
commit 6ccbb613b4
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/resctrl/mpam_devices.c
View File

@ -2581,6 +2581,9 @@ static void __destroy_component_cfg(struct mpam_component *comp)
lockdep_assert_held(&mpam_list_lock); lockdep_assert_held(&mpam_list_lock);
if (!comp->cfg)
return;
add_to_garbage(comp->cfg); add_to_garbage(comp->cfg);
list_for_each_entry(vmsc, &comp->vmsc, comp_list) { list_for_each_entry(vmsc, &comp->vmsc, comp_list) {
msc = vmsc->msc; msc = vmsc->msc;