mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
eadce0f46a
If the realloc for fda->entries succeeds but the realloc for fda->priv fails, the error path frees the newly allocated entries. However, fda->entries is neither updated to point to the new entries block nor cleared to NULL. If realloc moved the allocation to a new block, the old fda->entries pointer is now freed memory. When fdarray__exit() is later called to clean up, it executes free(fda->entries), which would trigger a double-free on that old pointer. Reported-by: Sashiko Review <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> |
||
|---|---|---|
| .. | ||
| fd | ||
| fs | ||
| Build | ||
| cpu.c | ||
| cpu.h | ||
| debug-internal.h | ||
| debug.c | ||
| debug.h | ||
| io_dir.h | ||
| io.h | ||
| Makefile | ||