Re: [PATCH 2/2] tracing/synthetic: Free type string on error path

[Steven Rostedt]

On Wed,  3 Jun 2026 14:25:33 +0800
Yu Peng <pen...@kylinos.cn> wrote:

> parse_synth_field() builds a "__data_loc ..." type string before
> assigning it to field->type. If the seq_buf check fails, the common
> cleanup cannot free the temporary string. Free it before leaving.
> 
> Signed-off-by: Yu Peng <pen...@kylinos.cn>
> ---
>  kernel/trace/trace_events_synth.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_events_synth.c 
> b/kernel/trace/trace_events_synth.c
> index cdd5b93328358..dc15658a887cb 100644
> --- a/kernel/trace/trace_events_synth.c
> +++ b/kernel/trace/trace_events_synth.c
> @@ -839,8 +839,10 @@ static struct synth_field *parse_synth_field(int argc, 
> char **argv,
>                       seq_buf_puts(&s, "__data_loc ");
>                       seq_buf_puts(&s, field->type);
>  
> -                     if (WARN_ON_ONCE(!seq_buf_buffer_left(&s)))
> +                     if (WARN_ON_ONCE(!seq_buf_buffer_left(&s))) {
> +                             kfree(type);
>                               goto free;
> +                     }
>                       s.buffer[s.len] = '\0';
>  
>                       kfree(field->type);

Can you do this instead?

diff --git a/kernel/trace/trace_events_synth.c 
b/kernel/trace/trace_events_synth.c
index cdd5b9332835..7ff0f00edbdd 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char 
**argv,
        } else if (size == 0) {
                if (synth_field_is_string(field->type) ||
                    synth_field_is_stack(field->type)) {
-                       char *type;
+                       char *type __free(kfree) = NULL;
 
                        len = sizeof("__data_loc ") + strlen(field->type) + 1;
                        type = kzalloc(len, GFP_KERNEL);
@@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char 
**argv,
                        s.buffer[s.len] = '\0';
 
                        kfree(field->type);
-                       field->type = type;
+                       field->type = no_free_ptr(type);
 
                        field->is_dynamic = true;
                        size = sizeof(u64);

-- Steve