[PATCH] arm_mpam: guard MBWU state before adding it to garbage

[PATCH] arm_mpam: guard MBWU state before adding it to garbage

[Guangshuo Li]

__destroy_component_cfg() adds each RIS mbwu_state object to the MPAM
garbage list when destroying component configuration.

However, mbwu_state is allocated per RIS and only for RISes with MBWU
monitors. A component can therefore have comp->cfg allocated while some
RISes still have ris->mbwu_state set to NULL.

Passing a NULL mbwu_state to add_to_garbage() dereferences the NULL
pointer inside the macro.

Skip RISes that do not have an mbwu_state object before adding them to
the garbage list.

Fixes: 41e8a14950e1 ("arm_mpam: Track bandwidth counter state for power management")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/resctrl/mpam_devices.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
index b69f99488111..59225694255f 100644
--- a/drivers/resctrl/mpam_devices.c
+++ b/drivers/resctrl/mpam_devices.c
@@ -2606,8 +2606,10 @@ static void __destroy_component_cfg(struct mpam_component *comp)
 		msc = vmsc->msc;
 
 		if (mpam_mon_sel_lock(msc)) {
-			list_for_each_entry(ris, &vmsc->ris, vmsc_list)
-				add_to_garbage(ris->mbwu_state);
+			list_for_each_entry(ris, &vmsc->ris, vmsc_list) {
+				if (ris->mbwu_state)
+					add_to_garbage(ris->mbwu_state);
+			}
 			mpam_mon_sel_unlock(msc);
 		}
 	}
-- 
2.43.0

Re: [PATCH] arm_mpam: guard MBWU state before adding it to garbage

[Ben Horgan]

Hi Guangshuo,

On 7/8/26 09:23, Guangshuo Li wrote:
> __destroy_component_cfg() adds each RIS mbwu_state object to the MPAM
> garbage list when destroying component configuration.
> 
> However, mbwu_state is allocated per RIS and only for RISes with MBWU
> monitors. A component can therefore have comp->cfg allocated while some
> RISes still have ris->mbwu_state set to NULL.
> 
> Passing a NULL mbwu_state to add_to_garbage() dereferences the NULL
> pointer inside the macro.
> 
> Skip RISes that do not have an mbwu_state object before adding them to
> the garbage list.
> 
> Fixes: 41e8a14950e1 ("arm_mpam: Track bandwidth counter state for power management")
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Good spot and thanks for the fix.

Reviewed-by: Ben Horgan <ben.horgan@arm.com>

> ---
>  drivers/resctrl/mpam_devices.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/resctrl/mpam_devices.c b/drivers/resctrl/mpam_devices.c
> index b69f99488111..59225694255f 100644
> --- a/drivers/resctrl/mpam_devices.c
> +++ b/drivers/resctrl/mpam_devices.c
> @@ -2606,8 +2606,10 @@ static void __destroy_component_cfg(struct mpam_component *comp)
>  		msc = vmsc->msc;
>  
>  		if (mpam_mon_sel_lock(msc)) {
> -			list_for_each_entry(ris, &vmsc->ris, vmsc_list)
> -				add_to_garbage(ris->mbwu_state);
> +			list_for_each_entry(ris, &vmsc->ris, vmsc_list) {
> +				if (ris->mbwu_state)
> +					add_to_garbage(ris->mbwu_state);
> +			}
>  			mpam_mon_sel_unlock(msc);
>  		}
>  	}