Re: [PATCH v2] tracing/synthetic: Free type string on error path
From: Steven Rostedt <rostedt@goodmis.org>
Date: 2026-07-07 17:54:22
Also in:
lkml
On Tue, 7 Jul 2026 21:24:17 +0800 Yu Peng [off-list ref] wrote:
quoted hunk ↗ jump to hunk
parse_synth_field() builds a "__data_loc ..." type string before assigning it to field->type. If the seq_buf check fails, the temporary string is not owned by field and is leaked. Free it before leaving. Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Yu Peng <redacted> --- Changes in v2: - Use __free(kfree) and no_free_ptr() as suggested by Steven. kernel/trace/trace_events_synth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c index e6871230bde96..ad2e70258291b 100644 --- a/kernel/trace/trace_events_synth.c +++ b/kernel/trace/trace_events_synth.c@@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv, } else if (size == 0) { if (synth_field_is_string(field->type) || synth_field_is_stack(field->type)) { - char *type; + char *type __free(kfree) = NULL;
Ah, we can't do this here. (Sashiko pointed this out: https://sashiko.dev/#/patchset/20260707132417.2193412-1-pengyu%40kylinos.cn )
len = sizeof("__data_loc ") + strlen(field->type) + 1;
type = kzalloc(len, GFP_KERNEL);Because after this code we have: type = kzalloc(len, GFP_KERNEL); if (!type) goto free; Which jumps out of the if block, and that will break the cleanup. I'll take you original version for now. -- Steve
quoted hunk ↗ jump to hunk
@@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv, s.buffer[s.len] = '\0'; kfree(field->type); - field->type = type; + field->type = no_free_ptr(type); field->is_dynamic = true; size = sizeof(u64);