On Thu, Nov 13, 2025 at 01:02:21PM +0000, [email protected] wrote: > > diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h > > index ded3a306a..433c36c3a 100644 > > --- a/include/linux/ftrace.h > > +++ b/include/linux/ftrace.h > > @@ -543,6 +543,7 @@ int modify_ftrace_direct(struct ftrace_ops *ops, > > unsigned long addr); > > int modify_ftrace_direct_nolock(struct ftrace_ops *ops, unsigned long > > addr); > > > > int update_ftrace_direct_add(struct ftrace_ops *ops, struct ftrace_hash > > *hash); > > +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash > > *hash); > > > > void ftrace_stub_direct_tramp(void); > > [ ... ] > > > diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c > > index 311ce6406..345f3fdd2 100644 > > --- a/kernel/trace/ftrace.c > > +++ b/kernel/trace/ftrace.c > > [ ... ] > > > +int update_ftrace_direct_del(struct ftrace_ops *ops, struct ftrace_hash > > *hash) > > +{ > > + struct ftrace_hash *new_hash = NULL, *filter_hash = NULL, *free_hash = > > NULL; > > + struct ftrace_func_entry *del, *entry; > > + unsigned long size, i; > > + int err = -EINVAL; > > + > > + if (!hash_count(hash)) > > + return 0; > > + if (check_direct_multi(ops)) > > + return -EINVAL; > > + if (!(ops->flags & FTRACE_OPS_FL_ENABLED)) > > + return -EINVAL; > > + if (direct_functions == EMPTY_HASH) > > + return -EINVAL; > > + > > + mutex_lock(&direct_mutex); > > + > > + /* Make sure requested entries are already registered. */ > > + size = 1 << hash->size_bits; > > + for (i = 0; i < size; i++) { > > + hlist_for_each_entry(entry, &hash->buckets[i], hlist) { > > + del = __ftrace_lookup_ip(direct_functions, entry->ip); > > + if (!del || del->direct != entry->direct) > > + goto out_unlock; > > + } > > + } > > + > > + err = -ENOMEM; > > + filter_hash = hash_sub(ops->func_hash->filter_hash, hash); > > + if (!filter_hash) > > + goto out_unlock; > > + > > + new_hash = hash_sub(direct_functions, hash); > > + if (!new_hash) > > + goto out_unlock; > > Can this leak new_hash? If hash_sub() succeeds for both filter_hash > and new_hash, but then either unregister_ftrace_function() or > ftrace_update_ops() fails below, we goto out_unlock without freeing > new_hash. The cleanup code only frees filter_hash: > > > + > > + /* If there's nothing left, we need to unregister the ops. */ > > + if (ftrace_hash_empty(filter_hash)) { > > + err = unregister_ftrace_function(ops); > > + /* cleanup for possible another register call */ > > + ops->func = NULL; > > + ops->trampoline = 0; > > + ftrace_free_filter(ops); > > + ops->func_hash->filter_hash = NULL; > > + } else { > > + err = ftrace_update_ops(ops, filter_hash, EMPTY_HASH); > > + } > > + > > + if (!err) { > > + free_hash = direct_functions; > > + rcu_assign_pointer(direct_functions, new_hash); > > + } > > + > > + out_unlock: > > + mutex_unlock(&direct_mutex); > > + > > + if (free_hash && free_hash != EMPTY_HASH) > > + call_rcu_tasks(&free_hash->rcu, register_ftrace_direct_cb); > > + if (filter_hash) > > + free_ftrace_hash(filter_hash); > > + > > + return err; > > +} > > If err != 0, new_hash remains allocated but is never freed. Should the > cleanup code add free_ftrace_hash(new_hash) when it's non-NULL?
yep, that's a miss, will fix thanks, jirka
