[PATCH] sched/topology: fix memory leaks in allocation failure paths

["monios114514@outlook.com" <monios114514@outlook.com>]

From c58bc2361ab78a5d978a3962dd9e88089a09d11b Mon Sep 17 00:00:00 2001
From: cpumsconfig <monios114514@outlook.com>
Date: Thu, 9 Jul 2026 21:58:41 +0800
Subject: [PATCH] sched/topology: fix memory leaks in allocation failure paths

Fix three memory leaks in the scheduler topology code when memory
allocation fails:

1. sched_init_numa(): When per-node masks[i] or inner mask allocation
   fails, previously allocated masks[0..i-1] and the masks array itself
   are not freed before return. The separately allocated domain_distances
   also leaks.

2. __sdt_alloc(): When per-CPU sd/sg/sgc allocation fails in the inner
   loop, already allocated per-CPU pointers for completed CPUs leak.
   Fix by using a unified fail label that calls __sdt_free().

3. __sds_alloc(): When percpu d->sds allocation succeeds but inner
   kzalloc_node fails, d->sds leaks. Fix by calling __sds_free().

Signed-off-by: cpumsconfig <monios114514@outlook.com>
---
 kernel/sched/topology.c | 99 ++++++++++++++++++++++-------------------
 1 file changed, 53 insertions(+), 46 deletions(-)

diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 622e2e019..fb5200b58 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -2320,12 +2320,10 @@ void sched_init_numa(int offline_node)
 	int *distances, *domain_distances;
 	struct cpumask ***masks;
 
-	/* Record the NUMA distances from SLIT table */
 	if (sched_record_numa_dist(offline_node, numa_node_dist, &distances,
 				   &nr_node_levels))
 		return;
 
-	/* Record modified NUMA distances for building sched domains */
 	if (modified_sched_node_distance()) {
 		if (sched_record_numa_dist(offline_node, arch_sched_node_distance,
 					   &domain_distances, &nr_levels)) {
@@ -2340,45 +2338,43 @@ void sched_init_numa(int offline_node)
 	WRITE_ONCE(sched_max_numa_distance, distances[nr_node_levels - 1]);
 	WRITE_ONCE(sched_numa_node_levels, nr_node_levels);
 
-	/*
-	 * 'nr_levels' contains the number of unique distances
-	 *
-	 * The sched_domains_numa_distance[] array includes the actual distance
-	 * numbers.
-	 */
-
-	/*
-	 * Here, we should temporarily reset sched_domains_numa_levels to 0.
-	 * If it fails to allocate memory for array sched_domains_numa_masks[][],
-	 * the array will contain less then 'nr_levels' members. This could be
-	 * dangerous when we use it to iterate array sched_domains_numa_masks[][]
-	 * in other functions.
-	 *
-	 * We reset it to 'nr_levels' at the end of this function.
-	 */
 	rcu_assign_pointer(sched_domains_numa_distance, domain_distances);
 
 	sched_domains_numa_levels = 0;
 
 	masks = kzalloc(sizeof(void *) * nr_levels, GFP_KERNEL);
 	if (!masks)
-		return;
+		goto free_distance;
 
-	/*
-	 * Now for each level, construct a mask per node which contains all
-	 * CPUs of nodes that are that many hops away from us.
-	 */
 	for (i = 0; i < nr_levels; i++) {
 		masks[i] = kzalloc(nr_node_ids * sizeof(void *), GFP_KERNEL);
-		if (!masks[i])
-			return;
+		if (!masks[i]) {
+			for (i = i - 1; i >= 0; i--) {
+				if (!masks[i])
+					continue;
+				for_each_cpu_node_but(j, offline_node)
+					kfree(masks[i][j]);
+				kfree(masks[i]);
+			}
+			kfree(masks);
+			goto free_distance;
+		}
 
 		for_each_cpu_node_but(j, offline_node) {
 			struct cpumask *mask = kzalloc(cpumask_size(), GFP_KERNEL);
 			int k;
 
-			if (!mask)
-				return;
+			if (!mask) {
+				for (i = i; i >= 0; i--) {
+					if (!masks[i])
+						continue;
+					for_each_cpu_node_but(j, offline_node)
+						kfree(masks[i][j]);
+					kfree(masks[i]);
+				}
+				kfree(masks);
+				goto free_distance;
+			}
 
 			masks[i][j] = mask;
 
@@ -2398,28 +2394,28 @@ void sched_init_numa(int offline_node)
 	}
 	rcu_assign_pointer(sched_domains_numa_masks, masks);
 
-	/* Compute default topology size */
 	for (i = 0; sched_domain_topology[i].mask; i++);
 
 	tl = kzalloc((i + nr_levels + 1) *
 			sizeof(struct sched_domain_topology_level), GFP_KERNEL);
-	if (!tl)
-		return;
+	if (!tl) {
+		rcu_assign_pointer(sched_domains_numa_masks, NULL);
+		for (i = nr_levels - 1; i >= 0; i--) {
+			if (!masks[i])
+				continue;
+			for_each_cpu_node_but(j, offline_node)
+				kfree(masks[i][j]);
+			kfree(masks[i]);
+		}
+		kfree(masks);
+		goto free_distance;
+	}
 
-	/*
-	 * Copy the default topology bits..
-	 */
 	for (i = 0; sched_domain_topology[i].mask; i++)
 		tl[i] = sched_domain_topology[i];
 
-	/*
-	 * Add the NUMA identity distance, aka single NODE.
-	 */
 	tl[i++] = SDTL_INIT(sd_numa_mask, NULL, NODE);
 
-	/*
-	 * .. and append 'j' levels of NUMA goodness.
-	 */
 	for (j = 1; j < nr_levels; i++, j++) {
 		tl[i] = SDTL_INIT(sd_numa_mask, cpu_numa_flags, NUMA);
 		tl[i].numa_level = j;
@@ -2431,6 +2427,11 @@ void sched_init_numa(int offline_node)
 	sched_domains_numa_levels = nr_levels;
 
 	init_numa_topology_type(offline_node);
+	return;
+
+free_distance:
+	if (domain_distances != distances)
+		kfree(domain_distances);
 }
 
 
@@ -2670,15 +2671,15 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 
 		sdd->sd = alloc_percpu(struct sched_domain *);
 		if (!sdd->sd)
-			return -ENOMEM;
+			goto fail;
 
 		sdd->sg = alloc_percpu(struct sched_group *);
 		if (!sdd->sg)
-			return -ENOMEM;
+			goto fail;
 
 		sdd->sgc = alloc_percpu(struct sched_group_capacity *);
 		if (!sdd->sgc)
-			return -ENOMEM;
+			goto fail;
 
 		for_each_cpu(j, cpu_map) {
 			struct sched_domain *sd;
@@ -2688,14 +2689,14 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 			sd = kzalloc_node(sizeof(struct sched_domain) + cpumask_size(),
 					GFP_KERNEL, cpu_to_node(j));
 			if (!sd)
-				return -ENOMEM;
+				goto fail;
 
 			*per_cpu_ptr(sdd->sd, j) = sd;
 
 			sg = kzalloc_node(sizeof(struct sched_group) + cpumask_size(),
 					GFP_KERNEL, cpu_to_node(j));
 			if (!sg)
-				return -ENOMEM;
+				goto fail;
 
 			sg->next = sg;
 
@@ -2704,7 +2705,7 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 			sgc = kzalloc_node(sizeof(struct sched_group_capacity) + cpumask_size(),
 					GFP_KERNEL, cpu_to_node(j));
 			if (!sgc)
-				return -ENOMEM;
+				goto fail;
 
 			sgc->id = j;
 
@@ -2713,6 +2714,10 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 	}
 
 	return 0;
+
+fail:
+	__sdt_free(cpu_map);
+	return -ENOMEM;
 }
 
 static void __sdt_free(const struct cpumask *cpu_map)
@@ -2760,8 +2765,10 @@ static int __sds_alloc(struct s_data *d, const struct cpumask *cpu_map)
 
 		sds = kzalloc_node(sizeof(struct sched_domain_shared),
 				GFP_KERNEL, cpu_to_node(j));
-		if (!sds)
+		if (!sds) {
+			__sds_free(d, cpu_map);
 			return -ENOMEM;
+		}
 
 		*per_cpu_ptr(d->sds, j) = sds;
 	}
-- 
2.54.0.windows.1