Re: [PATCH] mm/mempolicy: fix memory leak in weighted_interleave_auto_store()

[Andrew Morton <akpm@linux-foundation.org>]

On Tue, 31 Mar 2026 12:53:40 -0400 Gregory Price <gourry@gourry.net> wrote:

> On Tue, Mar 31, 2026 at 06:07:40PM +0800, Jackie Liu wrote:
> > From: Jackie Liu <liuyun01@kylinos.cn>
> > 
> > Add the missing kfree(new_wi_state) when the auto mode is already set
> > to the requested value. When a user writes "false" to the auto sysfs
> > interface and the current mode is already manual (mode_auto == false),
> > the function returns early without freeing new_wi_state allocated at
> > the beginning of the function. This can be triggered repeatedly from
> > userspace, leaking memory on each write.
> > 
> > Fixes: e341f9c3c841 ("mm/mempolicy: Weighted Interleave Auto-tuning")
> > Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> 
> ..
>
> > --- a/mm/mempolicy.c
> > +++ b/mm/mempolicy.c
> > @@ -3713,6 +3713,7 @@ static ssize_t weighted_interleave_auto_store(struct kobject *kobj,
> >  			goto update_wi_state;
> >  		if (input == old_wi_state->mode_auto) {
> >  			mutex_unlock(&wi_state_lock);
> > +			kfree(new_wi_state);
> >  			return count;
> >  		}
> >  

Thanks all.

Am I correct in believing that triggering this leak requires elevated
privileges?

I'll add cc:stable to this and shall queue it for 7.1-rc1. 
This means (I assume) that its entry into the -stable trees might be a
little later than if we were to upstream it immediately.

AI review liked this patch but claims to have found another one:
https://sashiko.dev/#/patchset/20260331100740.84906-1-liu.yun@linux.dev