On Thu, 30 Jul 2026 09:13:08 +0100 Vincent Donnefort <[email protected]> wrote:
> On Thu, Jul 30, 2026 at 04:01:51PM +0900, Masami Hiramatsu (Google) wrote: > > From: Masami Hiramatsu (Google) <[email protected]> > > > > In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using > > kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation > > fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages() > > fails), execution jumps to fail_free_reader. > > > > While __free(kfree) automatically frees the outer cpu_buffer structure > > at scope exit, kfree(cpu_buffer) does not recursively free nested heap > > pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak. > > > > Fix this by explicitly freeing cpu_buffer->subbuf_ids in the > > fail_free_reader error unwinding path when cpu_buffer->remote is set. > > > > Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") > > Assisted-by: Antigravity:gemini-3.6-flash > > Signed-off-by: Masami Hiramatsu (Google) <[email protected]> > > --- > > kernel/trace/ring_buffer.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c > > index 78d3875a47a5..03f6baf6a5f5 100644 > > --- a/kernel/trace/ring_buffer.c > > +++ b/kernel/trace/ring_buffer.c > > @@ -2599,6 +2599,8 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, > > long nr_pages, int cpu) > > return_ptr(cpu_buffer); > > > > fail_free_reader: > > + if (cpu_buffer->remote) > > + kfree(cpu_buffer->subbuf_ids); > > alloc_cpu_buffer() being kzalloc, I suppose here we could just unconditionally > call kfree(cpu_buffer->subbuf_ids) ? > Ah, indeed. Thanks for the comment! > > free_buffer_page(cpu_buffer->reader_page); > > > > return NULL; > > > > -- > Vincent -- Masami Hiramatsu (Google) <[email protected]>
