Re: [PATCH] perf/aux: Fix a memory leak on AUX allocation failure

[sashiko-bot@kernel.org]

> rb_alloc_aux() allocates rb->aux_pages before allocating the AUX data
> pages. If the first rb_alloc_aux_page() call fails, rb->aux_nr_pages is
> still zero, so __rb_free_aux() skips freeing the pointer array.
> 
> Commit ee9397a6fb9bc ("perf: Fix double-free of the AUX buffer") added
> the aux_nr_pages guard because AUX cleanup and main ring buffer release
> shared an IRQ-work callback that could call __rb_free_aux() twice.
> 
> Since commit 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
> removed that shared cleanup path, main ring buffer release no longer
> invokes AUX cleanup. The earlier double-free race is therefore gone, so
> the guard is no longer needed for freeing the pointer array.
> 
> Free rb->aux_pages unconditionally to cover the zero-page failure case.
> 
> Fixes: 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
> Closes: https://sashiko.dev/#/bug/linux-c1a2bb3b-5d2a-4fca-a697-ce07992a5cc1
> Signed-off-by: Leo Yan <leo.yan@arm.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-perf_fix_aux_page_memleak-v1-1-aae781d6749c@arm.com?part=1