Namhyung Kim eadce0f46a tools/lib/api: Fix potential double-free from fdarray__grow() ...

If the realloc for fda->entries succeeds but the realloc for fda->priv
fails, the error path frees the newly allocated entries.

However, fda->entries is neither updated to point to the new entries block
nor cleared to NULL. If realloc moved the allocation to a new block, the
old fda->entries pointer is now freed memory.

When fdarray__exit() is later called to clean up, it executes
free(fda->entries), which would trigger a double-free on that old pointer.

Reported-by: Sashiko Review <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>

2026-07-16 09:56:47 -07:00

..

array.c

tools/lib/api: Fix potential double-free from fdarray__grow()

2026-07-16 09:56:47 -07:00

array.h

perf record: Fix way of handling non-perf-event pollfds

2022-10-04 08:55:19 -03:00

Build

…