Re: [PATCH v10 RESEND 03/15] arm_mpam: Fix error return in resctrl_arch_mon_ctx_alloc()

[Jinjie Ruan]

在 2026/10/26 22:40, Ben Horgan 写道:
> Hi Jinjie,
> 
> On 20/10/2026 14:42, Jinjie Ruan wrote:
>> resctrl_arch_mon_ctx_alloc() stores the allocation result in a
>> heap-allocated int and returns the pointer unconditionally. When
>> allocation fails with anything other than a retryable -ENOSPC (e.g.
>> -EINVAL, -EOPNOTSUPP, or -ENOSPC with a pending signal), the caller
>> receives a valid heap pointer that IS_ERR() does not detect.
>>
>> The caller then treats the error code as a monitor index: hardware
>> reads use an out-of-range index, and resctrl_arch_mon_ctx_free() hands
>> it to ida_free(), corrupting the allocator state.
>>
>> Return ERR_PTR() when the allocation failed.
> 
> Is this just theoretical? What state do we have to be in for resctrl_arch_mon_ctx_alloc_no_wait() to
> fail? I see that the same fix has already been posted by Sang-Hoon.

Hi Ben,

Yes, this is one of sashiko reported issues. And after walking through
the relevant code, I found it to be reasonable.

Sorry, I didn't notice Sang-Hoon's fix; I will drop this fix.
> 
> https://lore.kernel.org/lkml/179075213853.3.16001626385793291460.idr-bug-33@xxxxxxxxx/
> 
> Thanks,
> 
> Ben
> 
>>
>> Fixes: 2a3c79c61539 ("arm_mpam: resctrl: Allow resctrl to allocate monitors")
>> Cc: James Morse <james.morse@xxxxxxx>
>> Signed-off-by: Jinjie Ruan <ruanjinjie@xxxxxxxxxx>
>> ---
>>  drivers/resctrl/mpam_resctrl.c | 7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/resctrl/mpam_resctrl.c b/drivers/resctrl/mpam_resctrl.c
>> index edd8da460fd7..23a8771ef148 100644
>> --- a/drivers/resctrl/mpam_resctrl.c
>> +++ b/drivers/resctrl/mpam_resctrl.c
>> @@ -413,6 +413,13 @@ void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r,
>>  	} while (*ret == -ENOSPC && !signal_pending(current));
>>  	finish_wait(&resctrl_mon_ctx_waiters, &wait);
>>  
>> +	if (*ret < 0) {
>> +		int err = *ret;
>> +
>> +		kfree(ret);
>> +		return ERR_PTR(err);
>> +	}
>> +
>>  	return ret;
> 
> 
>>  }
>>  
> 

-- 
Best regards,
Jinjie