Re: mm/mempolicy.c:3719:1-6: ERROR: invalid free of structure field

[Harry Yoo <harry.yoo@oracle.com>]

On Sun, Jun 01, 2025 at 01:34:46PM +0800, kernel test robot wrote:
> cocci warnings: (new ones prefixed by >>)
> >> mm/mempolicy.c:3719:1-6: ERROR: invalid free of structure field
> 
> vim +3719 mm/mempolicy.c
> 
>   3700	
>   3701	static void wi_state_free(void)
>   3702	{
>   3703		struct weighted_interleave_state *old_wi_state;
>   3704	
>   3705		mutex_lock(&wi_state_lock);
>   3706	
>   3707		old_wi_state = rcu_dereference_protected(wi_state,
>   3708				lockdep_is_held(&wi_state_lock));
>   3709		if (!old_wi_state) {
>   3710			mutex_unlock(&wi_state_lock);
>   3711			goto out;
>   3712		}
>   3713	
>   3714		rcu_assign_pointer(wi_state, NULL);
>   3715		mutex_unlock(&wi_state_lock);
>   3716		synchronize_rcu();
>   3717		kfree(old_wi_state);
>   3718	out:
> > 3719		kfree(&wi_group->wi_kobj);

Hmm maybe Joshua meant kfree(wi_group)?

Anyway, practically it's the same as kfree(wi_group) and something strange
is happening there.

in add_weighted_interleave_group() (the only caller of wi_cleanup()),
kobject_del() and kobject_put() are called after wi_cleanup() freed
wi_group in the error path.

>   3720	}
>   3721	
> 
> -- 
> 0-DAY CI Kernel Test Service

-- 
Cheers,
Harry / Hyeonggon