Re: [PATCH v10 RESEND 03/15] arm_mpam: Fix error return in resctrl_arch_mon_ctx_alloc()

[Ben Horgan <ben.horgan@arm.com>]

Hi Jinjie,

On 20/10/2026 14:42, Jinjie Ruan wrote:
> resctrl_arch_mon_ctx_alloc() stores the allocation result in a
> heap-allocated int and returns the pointer unconditionally. When
> allocation fails with anything other than a retryable -ENOSPC (e.g.
> -EINVAL, -EOPNOTSUPP, or -ENOSPC with a pending signal), the caller
> receives a valid heap pointer that IS_ERR() does not detect.
> 
> The caller then treats the error code as a monitor index: hardware
> reads use an out-of-range index, and resctrl_arch_mon_ctx_free() hands
> it to ida_free(), corrupting the allocator state.
> 
> Return ERR_PTR() when the allocation failed.

Is this just theoretical? What state do we have to be in for resctrl_arch_mon_ctx_alloc_no_wait() to
fail? I see that the same fix has already been posted by Sang-Hoon.

https://lore.kernel.org/lkml/179075213853.3.16001626385793291460.idr-bug-33@gmail.com/

Thanks,

Ben

> 
> Fixes: 2a3c79c61539 ("arm_mpam: resctrl: Allow resctrl to allocate monitors")
> Cc: James Morse <james.morse@arm.com>
> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
> ---
>  drivers/resctrl/mpam_resctrl.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/resctrl/mpam_resctrl.c b/drivers/resctrl/mpam_resctrl.c
> index edd8da460fd7..23a8771ef148 100644
> --- a/drivers/resctrl/mpam_resctrl.c
> +++ b/drivers/resctrl/mpam_resctrl.c
> @@ -413,6 +413,13 @@ void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r,
>  	} while (*ret == -ENOSPC && !signal_pending(current));
>  	finish_wait(&resctrl_mon_ctx_waiters, &wait);
>  
> +	if (*ret < 0) {
> +		int err = *ret;
> +
> +		kfree(ret);
> +		return ERR_PTR(err);
> +	}
> +
>  	return ret;


>  }
>