[PATCH v2] s390/mm: Fix memory leak in add_marker() when kvrealloc fails

[PATCH v2] s390/mm: Fix memory leak in add_marker() when kvrealloc fails

[Miaoqian Lin]

The function has a memory leak when kvrealloc() fails.
The function directly assigns NULL to the markers pointer, losing the
reference to the previously allocated memory. This causes kvfree() in
pt_dump_init() to free NULL instead of the leaked memory.

Fix by:
1. Using kvrealloc() uniformly for all allocations
2. Using a temporary variable to preserve the original pointer until
   allocation succeeds
3. Removing the error path that sets markers_cnt=0 to keep
   consistency between markers and markers_cnt

Found via static analysis and this is similar to commit 42378a9ca553
("bpf, verifier: Fix memory leak in array reallocation for stack state")

Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
changes in v2:
- update the fixing logic to prevent memory leak in v1
v1 link: https://lore.kernel.org/all/20251026091351.36275-1-linmq006@gmail.com/
---
 arch/s390/mm/dump_pagetables.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
index 9af2aae0a515..ab0c1fcf2782 100644
--- a/arch/s390/mm/dump_pagetables.c
+++ b/arch/s390/mm/dump_pagetables.c
@@ -291,16 +291,15 @@ static int ptdump_cmp(const void *a, const void *b)
 
 static int add_marker(unsigned long start, unsigned long end, const char *name)
 {
-	size_t oldsize, newsize;
-
-	oldsize = markers_cnt * sizeof(*markers);
-	newsize = oldsize + 2 * sizeof(*markers);
-	if (!oldsize)
-		markers = kvmalloc(newsize, GFP_KERNEL);
-	else
-		markers = kvrealloc(markers, newsize, GFP_KERNEL);
-	if (!markers)
-		goto error;
+	struct addr_marker *new_markers;
+	size_t newsize;
+
+	newsize = (markers_cnt + 2) * sizeof(*markers);
+	new_markers = kvrealloc(markers, newsize, GFP_KERNEL);
+	if (!new_markers)
+		return -ENOMEM;
+
+	markers = new_markers;
 	markers[markers_cnt].is_start = 1;
 	markers[markers_cnt].start_address = start;
 	markers[markers_cnt].size = end - start;
@@ -312,9 +311,6 @@ static int add_marker(unsigned long start, unsigned long end, const char *name)
 	markers[markers_cnt].name = name;
 	markers_cnt++;
 	return 0;
-error:
-	markers_cnt = 0;
-	return -ENOMEM;
 }
 
 static int pt_dump_init(void)
-- 
2.39.5 (Apple Git-154)

Re: [PATCH v2] s390/mm: Fix memory leak in add_marker() when kvrealloc fails

[Heiko Carstens]

On Mon, Oct 27, 2025 at 11:08:38PM +0800, Miaoqian Lin wrote:
> The function has a memory leak when kvrealloc() fails.
> The function directly assigns NULL to the markers pointer, losing the
> reference to the previously allocated memory. This causes kvfree() in
> pt_dump_init() to free NULL instead of the leaked memory.
> 
> Fix by:
> 1. Using kvrealloc() uniformly for all allocations
> 2. Using a temporary variable to preserve the original pointer until
>    allocation succeeds
> 3. Removing the error path that sets markers_cnt=0 to keep
>    consistency between markers and markers_cnt
> 
> Found via static analysis and this is similar to commit 42378a9ca553
> ("bpf, verifier: Fix memory leak in array reallocation for stack state")
> 
> Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically")
> Cc: stable@vger.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
> ---
> changes in v2:
> - update the fixing logic to prevent memory leak in v1
> v1 link: https://lore.kernel.org/all/20251026091351.36275-1-linmq006@gmail.com/
> ---
>  arch/s390/mm/dump_pagetables.c | 22 +++++++++-------------
>  1 file changed, 9 insertions(+), 13 deletions(-)

Applied, thanks!