> diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
> index ded3a306a..433c36c3a 100644
> --- a/include/linux/ftrace.h
> +++ b/include/linux/ftrace.h
> @@ -543,6 +543,7 @@ int modify_ftrace_direct(struct ftrace_ops *ops, unsigned
> long addr);
> int modify_ftrace_direct_nolock(struct ftrace_ops *ops, unsigned long addr);
>
> int update_ftrace_direct_add(struct ftrace_ops *ops, struct ftrace_hash
> *hash);
> +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash
> *hash);
>
> void ftrace_stub_direct_tramp(void);
[ ... ]
> diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
> index 311ce6406..345f3fdd2 100644
> --- a/kernel/trace/ftrace.c
> +++ b/kernel/trace/ftrace.c
[ ... ]
> +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash
> *hash)
> +{
> + struct ftrace_hash *new_hash = NULL, *filter_hash = NULL, *free_hash =
> NULL;
> + struct ftrace_func_entry *del, *entry;
> + unsigned long size, i;
> + int err = -EINVAL;
> +
> + if (!hash_count(hash))
> + return 0;
> + if (check_direct_multi(ops))
> + return -EINVAL;
> + if (!(ops->flags & FTRACE_OPS_FL_ENABLED))
> + return -EINVAL;
> + if (direct_functions == EMPTY_HASH)
> + return -EINVAL;
> +
> + mutex_lock(&direct_mutex);
> +
> + /* Make sure requested entries are already registered. */
> + size = 1 << hash->size_bits;
> + for (i = 0; i < size; i++) {
> + hlist_for_each_entry(entry, &hash->buckets[i], hlist) {
> + del = __ftrace_lookup_ip(direct_functions, entry->ip);
> + if (!del || del->direct != entry->direct)
> + goto out_unlock;
> + }
> + }
> +
> + err = -ENOMEM;
> + filter_hash = hash_sub(ops->func_hash->filter_hash, hash);
> + if (!filter_hash)
> + goto out_unlock;
> +
> + new_hash = hash_sub(direct_functions, hash);
> + if (!new_hash)
> + goto out_unlock;
Can this leak new_hash? If hash_sub() succeeds for both filter_hash
and new_hash, but then either unregister_ftrace_function() or
ftrace_update_ops() fails below, we goto out_unlock without freeing
new_hash. The cleanup code only frees filter_hash:
> +
> + /* If there's nothing left, we need to unregister the ops. */
> + if (ftrace_hash_empty(filter_hash)) {
> + err = unregister_ftrace_function(ops);
> + /* cleanup for possible another register call */
> + ops->func = NULL;
> + ops->trampoline = 0;
> + ftrace_free_filter(ops);
> + ops->func_hash->filter_hash = NULL;
> + } else {
> + err = ftrace_update_ops(ops, filter_hash, EMPTY_HASH);
> + }
> +
> + if (!err) {
> + free_hash = direct_functions;
> + rcu_assign_pointer(direct_functions, new_hash);
> + }
> +
> + out_unlock:
> + mutex_unlock(&direct_mutex);
> +
> + if (free_hash && free_hash != EMPTY_HASH)
> + call_rcu_tasks(&free_hash->rcu, register_ftrace_direct_cb);
> + if (filter_hash)
> + free_ftrace_hash(filter_hash);
> +
> + return err;
> +}
If err != 0, new_hash remains allocated but is never freed. Should the
cleanup code add free_ftrace_hash(new_hash) when it's non-NULL?
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/19332026793
