hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9840 ------------------ In __destroy_component_cfg() comp->cfg is freed with kfree() but not set to NULL, leaving a dangling pointer. If the function is subsequently called again (e.g. from the error path of __allocate_component_cfg()), the check "if (comp->cfg)" in __allocate_component_cfg() would see the stale non-NULL pointer and skip re-allocation, leading to a use-after-free when comp->cfg[partid] is later accessed. NULL the pointer after freeing to avoid the dangling reference. Fixes: 21ac9fc8f275 ("arm_mpam: Track bandwidth counter state for overflow and power management") Signed-off-by: Zeng Heng <zengheng4@huawei.com> --- drivers/platform/mpam/mpam_devices.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 418a341f3821a..73f105072ff43 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -2392,6 +2392,7 @@ static void __destroy_component_cfg(struct mpam_component *comp) struct msmon_mbwu_state *mbwu_state; kfree(comp->cfg); + comp->cfg = NULL; list_for_each_entry(ris, &comp->ris, comp_list) { mutex_lock(&ris->msc->lock); spin_lock_irqsave(&ris->msc->mon_sel_lock, flags); -- 2.43.0