On Mon, Sep 07, 2026 at 04:04:25AM +0000, [email protected] wrote: > - [High] Preexisting memory leak of VAR_REF hist_field objects when a > variable is referenced 3 or more times. > - [High] Preexisting memory leak of VAR_REF hist_field in create_var_ref > error path.
Both are real, and both already have fixes on the list: tracing: hist: free var refs regardless of how often they are referenced https://lore.kernel.org/linux-trace-kernel/[email protected]/ tracing: hist: free the var ref when its initialization fails https://lore.kernel.org/linux-trace-kernel/[email protected]/ The first removes the counter rather than changing the comparison. Its only decrement site has been a no-op since 656fe2ba85e8 ("tracing: Use hist trigger's var_ref array to destroy var_refs"), and var_refs[] is the sole owner of a var ref, so two references leak as well as three. The second switches that error path to __destroy_hist_field(), which is the one that does not skip HIST_FIELD_FL_VAR_REF. Neither overlaps with the patch under review. The field freed here is never a var ref: reaching the err label requires one of the modifier flags, and parse_atom() returns var refs before parse_field() can set any.
