[PATCH v2] tools/lib/api: Fix potential double-free from fdarray__grow()

[PATCH v2] tools/lib/api: Fix potential double-free from fdarray__grow()

[Namhyung Kim]

If the realloc for fda->entries succeeds but the realloc for fda->priv
fails, the error path frees the newly allocated entries.

However, fda->entries is neither updated to point to the new entries block
nor cleared to NULL. If realloc moved the allocation to a new block, the
old fda->entries pointer is now freed memory.

When fdarray__exit() is later called to clean up, it executes
free(fda->entries), which would trigger a double-free on that old pointer.

Reported-by: Sashiko Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
v2 changes)
 * update the patch subject

 tools/lib/api/fd/array.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
index ffe8272af59b2da0..23b476a35de477fe 100644
--- a/tools/lib/api/fd/array.c
+++ b/tools/lib/api/fd/array.c
@@ -31,7 +31,8 @@ int fdarray__grow(struct fdarray *fda, int nr)
 
 	priv = realloc(fda->priv, psize);
 	if (priv == NULL) {
-		free(entries);
+		/* this will be freed by fdarray__exit() */
+		fda->entries = entries;
 		return -ENOMEM;
 	}
 
@@ -50,7 +51,7 @@ struct fdarray *fdarray__new(int nr_alloc, int nr_autogrow)
 
 	if (fda != NULL) {
 		if (fdarray__grow(fda, nr_alloc)) {
-			free(fda);
+			fdarray__delete(fda);
 			fda = NULL;
 		} else {
 			fda->nr_autogrow = nr_autogrow;
-- 
2.55.0.795.g602f6c329a-goog

Re: [PATCH v2] tools/lib/api: Fix potential double-free from fdarray__grow()

[Ian Rogers]

On Fri, Jul 10, 2026 at 5:32 PM Namhyung Kim <namhyung@kernel.org> wrote:
>
> If the realloc for fda->entries succeeds but the realloc for fda->priv
> fails, the error path frees the newly allocated entries.
>
> However, fda->entries is neither updated to point to the new entries block
> nor cleared to NULL. If realloc moved the allocation to a new block, the
> old fda->entries pointer is now freed memory.
>
> When fdarray__exit() is later called to clean up, it executes
> free(fda->entries), which would trigger a double-free on that old pointer.
>
> Reported-by: Sashiko Review <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>

Reviewed-by: Ian Rogers <irogers@google.com>

Thanks,
Ian

> ---
> v2 changes)
>  * update the patch subject
>
>  tools/lib/api/fd/array.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
> index ffe8272af59b2da0..23b476a35de477fe 100644
> --- a/tools/lib/api/fd/array.c
> +++ b/tools/lib/api/fd/array.c
> @@ -31,7 +31,8 @@ int fdarray__grow(struct fdarray *fda, int nr)
>
>         priv = realloc(fda->priv, psize);
>         if (priv == NULL) {
> -               free(entries);
> +               /* this will be freed by fdarray__exit() */
> +               fda->entries = entries;
>                 return -ENOMEM;
>         }
>
> @@ -50,7 +51,7 @@ struct fdarray *fdarray__new(int nr_alloc, int nr_autogrow)
>
>         if (fda != NULL) {
>                 if (fdarray__grow(fda, nr_alloc)) {
> -                       free(fda);
> +                       fdarray__delete(fda);
>                         fda = NULL;
>                 } else {
>                         fda->nr_autogrow = nr_autogrow;
> --
> 2.55.0.795.g602f6c329a-goog
>

Re: [PATCH v2] tools/lib/api: Fix potential double-free from fdarray__grow()

[Namhyung Kim]

On Fri, 10 Jul 2026 17:32:35 -0700, Namhyung Kim wrote:
> If the realloc for fda->entries succeeds but the realloc for fda->priv
> fails, the error path frees the newly allocated entries.
> 
> However, fda->entries is neither updated to point to the new entries block
> nor cleared to NULL. If realloc moved the allocation to a new block, the
> old fda->entries pointer is now freed memory.
> 
> [...]
Applied to perf-tools-next, thanks!

Best regards,
Namhyung