Re: [PATCH v2] tools/lib/api: Fix potential double-free from fdarray__grow()

[Ian Rogers]

On Fri, Jul 10, 2026 at 5:32 PM Namhyung Kim <namhyung@xxxxxxxxxx> wrote:
>
> If the realloc for fda->entries succeeds but the realloc for fda->priv
> fails, the error path frees the newly allocated entries.
>
> However, fda->entries is neither updated to point to the new entries block
> nor cleared to NULL. If realloc moved the allocation to a new block, the
> old fda->entries pointer is now freed memory.
>
> When fdarray__exit() is later called to clean up, it executes
> free(fda->entries), which would trigger a double-free on that old pointer.
>
> Reported-by: Sashiko Review <sashiko-bot@xxxxxxxxxx>
> Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@xxxxxxxxxxxxxxx
> Signed-off-by: Namhyung Kim <namhyung@xxxxxxxxxx>

Reviewed-by: Ian Rogers <irogers@xxxxxxxxxx>

Thanks,
Ian

> ---
> v2 changes)
>  * update the patch subject
>
>  tools/lib/api/fd/array.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
> index ffe8272af59b2da0..23b476a35de477fe 100644
> --- a/tools/lib/api/fd/array.c
> +++ b/tools/lib/api/fd/array.c
> @@ -31,7 +31,8 @@ int fdarray__grow(struct fdarray *fda, int nr)
>
>         priv = realloc(fda->priv, psize);
>         if (priv == NULL) {
> -               free(entries);
> +               /* this will be freed by fdarray__exit() */
> +               fda->entries = entries;
>                 return -ENOMEM;
>         }
>
> @@ -50,7 +51,7 @@ struct fdarray *fdarray__new(int nr_alloc, int nr_autogrow)
>
>         if (fda != NULL) {
>                 if (fdarray__grow(fda, nr_alloc)) {
> -                       free(fda);
> +                       fdarray__delete(fda);
>                         fda = NULL;
>                 } else {
>                         fda->nr_autogrow = nr_autogrow;
> --
> 2.55.0.795.g602f6c329a-goog
>