Re: [BUG] dm-stats: null-ptr-deref in dm_stat_free on stats alloc failure

[Mikulas Patocka]

On Sat, 25 Jul 2026, Junzhe Yu wrote:

> Hello,
> 
> I am reporting a null-pointer dereference in device-mapper dm-stats when
> @stats_create fails part-way through per-CPU buffer allocation.
> 
> Summary
> =======
> 
> dm_stats_create() allocates per-CPU stat buffers in a loop. On mid-loop
> ENOMEM it jumps to out: and calls dm_stat_free(). dm_stat_free() then
> dereferences s->stat_percpu[cpu] without a NULL check, including for CPUs
> that never received a successful allocation (still NULL from zero-init).
> 
> The crash is a KASAN null-ptr-deref / general protection fault in
> dm_stat_free() at drivers/md/dm-stats.c, reached via DM_TARGET_MSG
> @stats_create.

Hi

Here I'm sending a patch for this bug.

Mikulas


dm-stats: fix a crash if allocation of per-cpu data fails

If "dm_kvzalloc(percpu_alloc_size, cpu_to_node(cpu))" fails, the code
jumps to the "out" label and calls dm_stat_free. dm_stat_free does
"for_each_possible_cpu(cpu) { dm_kvfree(s->stat_percpu[cpu][0].histogram,
s->histogram_alloc_size);", which crashes with NULL pointer dereference
if s->stat_percpu[cpu] is NULL.

This commit fixes the bug by testing s->stat_percpu[cpu] for NULL before
using it.

Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx

---
 drivers/md/dm-stats.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Index: linux-2.6/drivers/md/dm-stats.c
===================================================================
--- linux-2.6.orig/drivers/md/dm-stats.c	2026-07-13 20:58:56.000000000 +0200
+++ linux-2.6/drivers/md/dm-stats.c	2026-07-28 15:21:23.000000000 +0200
@@ -178,8 +178,10 @@ static void dm_stat_free(struct rcu_head
 	kfree(s->program_id);
 	kfree(s->aux_data);
 	for_each_possible_cpu(cpu) {
-		dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
-		dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+		if (s->stat_percpu[cpu]) {
+			dm_kvfree(s->stat_percpu[cpu][0].histogram, s->histogram_alloc_size);
+			dm_kvfree(s->stat_percpu[cpu], s->percpu_alloc_size);
+		}
 	}
 	dm_kvfree(s->stat_shared[0].tmp.histogram, s->histogram_alloc_size);
 	dm_kvfree(s, s->shared_alloc_size);