linux-kernel - Re: [PATCH] PCI/PTM: Fix memory leak in pcie_ptm_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <pdp4xc4d5ee3e547mmdro5riui3mclduqdl7j6iclfbozo2a4c@7m3qdm6yrhuv>
Date: Wed, 14 Jan 2026 12:58:56 +0530
From: Manivannan Sadhasivam <mani@...nel.org>
To: Aadityarangan Shridhar Iyengar <adiyenga@...co.com>
Cc: bhelgaas@...gle.com, linux-pci@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] PCI/PTM: Fix memory leak in pcie_ptm_create_debugfs()
 error path

On Sun, Jan 11, 2026 at 10:06:50PM +0530, Aadityarangan Shridhar Iyengar wrote:
> In pcie_ptm_create_debugfs(), if devm_kasprintf() fails after successfully
> allocating ptm_debugfs with kzalloc(), the function returns NULL without
> freeing the allocated memory, resulting in a memory leak.
> 
> Fix this by adding kfree(ptm_debugfs) before returning NULL in the
> devm_kasprintf() error path.
> 
> This leak is particularly problematic during memory pressure situations
> where devm_kasprintf() is more likely to fail, potentially compounding
> the memory exhaustion issue.
> 
> Fixes: 132833405e61 ("PCI: Add debugfs support for exposing PTM context")
> Signed-off-by: Aadityarangan Shridhar Iyengar <adiyenga@...co.com>
> ---
>  drivers/pci/pcie/ptm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
> index ed0f9691e7d1..09c0167048a3 100644
> --- a/drivers/pci/pcie/ptm.c
> +++ b/drivers/pci/pcie/ptm.c
> @@ -542,8 +542,10 @@ struct pci_ptm_debugfs *pcie_ptm_create_debugfs(struct device *dev, void *pdata,
>  		return NULL;
>  
>  	dirname = devm_kasprintf(dev, GFP_KERNEL, "pcie_ptm_%s", dev_name(dev));
> -	if (!dirname)
> +	if (!dirname) {
> +		kfree(ptm_debugfs);
>  		return NULL;
> +	}

Thanks for spotting the leak. I also forgot to remove it in
pcie_ptm_destroy_debugfs(). Since this one got applied, Bjorn could you please
squash the below fix as well?

diff --git a/drivers/pci/pcie/ptm.c b/drivers/pci/pcie/ptm.c
index ed0f9691e7d1..2c27bee0773d 100644
--- a/drivers/pci/pcie/ptm.c
+++ b/drivers/pci/pcie/ptm.c
@@ -574,6 +574,7 @@ void pcie_ptm_destroy_debugfs(struct pci_ptm_debugfs *ptm_debugfs)
 
        mutex_destroy(&ptm_debugfs->lock);
        debugfs_remove_recursive(ptm_debugfs->debugfs);
+       kfree(ptm_debugfs);
 }
 EXPORT_SYMBOL_GPL(pcie_ptm_destroy_debugfs);
 #endif

For this patch,

Reviewed-by: Manivannan Sadhasivam <mani@...nel.org>

- Mani

-- 
மணிவண்ணன் சதாசிவம்