[PATCH v10 03/15] arm_mpam: Fix error return in resctrl_arch_mon_ctx_alloc()

[Jinjie Ruan <2118537295@qq.com>]

From: Jinjie Ruan <ruanjinjie@huawei.com>

resctrl_arch_mon_ctx_alloc() stores the allocation result in a
heap-allocated int and returns the pointer unconditionally. When
allocation fails with anything other than a retryable -ENOSPC (e.g.
-EINVAL, -EOPNOTSUPP, or -ENOSPC with a pending signal), the caller
receives a valid heap pointer that IS_ERR() does not detect.

The caller then treats the error code as a monitor index: hardware
reads use an out-of-range index, and resctrl_arch_mon_ctx_free() hands
it to ida_free(), corrupting the allocator state.

Return ERR_PTR() when the allocation failed.

Fixes: 2a3c79c61539 ("arm_mpam: resctrl: Allow resctrl to allocate monitors")
Cc: James Morse <james.morse@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 drivers/resctrl/mpam_resctrl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/resctrl/mpam_resctrl.c b/drivers/resctrl/mpam_resctrl.c
index 9d223057953a..945be7465ad3 100644
--- a/drivers/resctrl/mpam_resctrl.c
+++ b/drivers/resctrl/mpam_resctrl.c
@@ -413,6 +413,13 @@ void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r,
 	} while (*ret == -ENOSPC && !signal_pending(current));
 	finish_wait(&resctrl_mon_ctx_waiters, &wait);
 
+	if (*ret < 0) {
+		int err = *ret;
+
+		kfree(ret);
+		return ERR_PTR(err);
+	}
+
 	return ret;
 }
 
-- 
2.43.0