On Tue, 7 Jul 2026 21:24:17 +0800 Yu Peng <[email protected]> wrote:
> parse_synth_field() builds a "__data_loc ..." type string before > assigning it to field->type. If the seq_buf check fails, the temporary > string is not owned by field and is leaked. Free it before leaving. > > Suggested-by: Steven Rostedt <[email protected]> > Signed-off-by: Yu Peng <[email protected]> > --- > Changes in v2: > - Use __free(kfree) and no_free_ptr() as suggested by Steven. > > kernel/trace/trace_events_synth.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/kernel/trace/trace_events_synth.c > b/kernel/trace/trace_events_synth.c > index e6871230bde96..ad2e70258291b 100644 > --- a/kernel/trace/trace_events_synth.c > +++ b/kernel/trace/trace_events_synth.c > @@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, > char **argv, > } else if (size == 0) { > if (synth_field_is_string(field->type) || > synth_field_is_stack(field->type)) { > - char *type; > + char *type __free(kfree) = NULL; Ah, we can't do this here. (Sashiko pointed this out: https://sashiko.dev/#/patchset/20260707132417.2193412-1-pengyu%40kylinos.cn ) > > len = sizeof("__data_loc ") + strlen(field->type) + 1; > type = kzalloc(len, GFP_KERNEL); Because after this code we have: type = kzalloc(len, GFP_KERNEL); if (!type) goto free; Which jumps out of the if block, and that will break the cleanup. I'll take you original version for now. -- Steve > @@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, > char **argv, > s.buffer[s.len] = '\0'; > > kfree(field->type); > - field->type = type; > + field->type = no_free_ptr(type); > > field->is_dynamic = true; > size = sizeof(u64);
