diff options
| author | James Morse <james.morse@arm.com> | 2026-05-08 19:23:39 +0300 |
|---|---|---|
| committer | Catalin Marinas <catalin.marinas@arm.com> | 2026-05-14 11:52:05 +0300 |
| commit | 6ccbb613b42a1f1ba7bfd547a148f644a902a25c (patch) | |
| tree | b891f723e8e4d9d8d6119f620e3241d803a6ded0 | |
| parent | f1caff3335ea6eab88cdc84ec8f2e3c45ca05486 (diff) | |
| download | linux-6ccbb613b42a1f1ba7bfd547a148f644a902a25c.tar.xz | |
arm_mpam: Check whether the config array is allocated before destroying it
__destroy_component_cfg() is called to free the configuration array.
It uses the embedded 'garbage' structure, which means the array has
to be allocated.
If __destroy_component_cfg() is called from mpam_disable() before the
configuration was ever allocated, then a NULL pointer is dereferenced.
Check for this case and return early if the configuration is not
allocated.
__destroy_component_cfg() also frees the mbwu_state as this is allocated
by __allocate_component_cfg(). As the mbwu_state is allocated after
comp->cfg is set, and is also under mpam_list_lock, only the first
pointer needs checking.
Fixes: 3bd04fe7d807 ("arm_mpam: Extend reset logic to allow devices to be reset any time")
Cc: <stable@vger.kernel.org>
Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by: Ben Horgan <ben.horgan@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
| -rw-r--r-- | drivers/resctrl/mpam_devices.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c index 5c48812d8573..988fc291241d 100644 --- a/drivers/resctrl/mpam_devices.c +++ b/drivers/resctrl/mpam_devices.c @@ -2581,6 +2581,9 @@ static void __destroy_component_cfg(struct mpam_component *comp) lockdep_assert_held(&mpam_list_lock); + if (!comp->cfg) + return; + add_to_garbage(comp->cfg); list_for_each_entry(vmsc, &comp->vmsc, comp_list) { msc = vmsc->msc; |