[PATCH] perf/aux: Fix a memory leak on AUX allocation failure

[PATCH] perf/aux: Fix a memory leak on AUX allocation failure

[Leo Yan]

rb_alloc_aux() allocates rb->aux_pages before allocating the AUX data
pages. If the first rb_alloc_aux_page() call fails, rb->aux_nr_pages is
still zero, so __rb_free_aux() skips freeing the pointer array.

Commit ee9397a6fb9bc ("perf: Fix double-free of the AUX buffer") added
the aux_nr_pages guard because AUX cleanup and main ring buffer release
shared an IRQ-work callback that could call __rb_free_aux() twice.

Since commit 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
removed that shared cleanup path, main ring buffer release no longer
invokes AUX cleanup. The earlier double-free race is therefore gone, so
the guard is no longer needed for freeing the pointer array.

Free rb->aux_pages unconditionally to cover the zero-page failure case.

Fixes: 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
Closes: https://sashiko.dev/#/bug/linux-c1a2bb3b-5d2a-4fca-a697-ce07992a5cc1
Signed-off-by: Leo Yan <leo.yan@arm.com>
---
 kernel/events/ring_buffer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index 95f4fbdfd2764de5b72d901d778c46302f525fad..687d89c1fd5fe06963ba2a9563887d5f0d693e93 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -674,9 +674,10 @@ static void __rb_free_aux(struct perf_buffer *rb)
 		for (pg = 0; pg < rb->aux_nr_pages; pg++)
 			rb_free_aux_page(rb, pg);
 
-		kfree(rb->aux_pages);
 		rb->aux_nr_pages = 0;
 	}
+
+	kfree(rb->aux_pages);
 }
 
 int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,

---
base-commit: 2651f6deb3326129a052897df193052dc28ea94f
change-id: 20261109-perf_fix_aux_page_memleak-9dc37fcb8433

Best regards,
-- 
Leo Yan <leo.yan@arm.com>

Re: [PATCH] perf/aux: Fix a memory leak on AUX allocation failure

[sashiko-bot]

> rb_alloc_aux() allocates rb->aux_pages before allocating the AUX data
> pages. If the first rb_alloc_aux_page() call fails, rb->aux_nr_pages is
> still zero, so __rb_free_aux() skips freeing the pointer array.
> 
> Commit ee9397a6fb9bc ("perf: Fix double-free of the AUX buffer") added
> the aux_nr_pages guard because AUX cleanup and main ring buffer release
> shared an IRQ-work callback that could call __rb_free_aux() twice.
> 
> Since commit 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
> removed that shared cleanup path, main ring buffer release no longer
> invokes AUX cleanup. The earlier double-free race is therefore gone, so
> the guard is no longer needed for freeing the pointer array.
> 
> Free rb->aux_pages unconditionally to cover the zero-page failure case.
> 
> Fixes: 95ff4ca26c49 ("perf/core: Free AUX pages in unmap path")
> Closes: https://sashiko.dev/#/bug/linux-c1a2bb3b-5d2a-4fca-a697-ce07992a5cc1
> Signed-off-by: Leo Yan <leo.yan@arm.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-perf_fix_aux_page_memleak-v1-1-aae781d6749c@arm.com?part=1