Re: [PATCH] tracing: hist: free the field rejected for a bad modifier

[Donggeun Yoo <donggeunyoo.kernel@gmail.com>]

On Mon, Sep 07, 2026 at 04:04:25AM +0000, sashiko-bot@kernel.org wrote:
> - [High] Preexisting memory leak of VAR_REF hist_field objects when a
> variable is referenced 3 or more times.
> - [High] Preexisting memory leak of VAR_REF hist_field in create_var_ref
> error path.

Both are real, and both already have fixes on the list:

  tracing: hist: free var refs regardless of how often they are referenced
  https://lore.kernel.org/linux-trace-kernel/20260906124025.3550596-1-donggeunyoo.kernel@gmail.com/

  tracing: hist: free the var ref when its initialization fails
  https://lore.kernel.org/linux-trace-kernel/20260906133352.3815019-1-donggeunyoo.kernel@gmail.com/

The first removes the counter rather than changing the comparison. Its only
decrement site has been a no-op since 656fe2ba85e8 ("tracing: Use hist
trigger's var_ref array to destroy var_refs"), and var_refs[] is the sole
owner of a var ref, so two references leak as well as three.

The second switches that error path to __destroy_hist_field(), which is the
one that does not skip HIST_FIELD_FL_VAR_REF.

Neither overlaps with the patch under review. The field freed here is never
a var ref: reaching the err label requires one of the modifier flags, and
parse_atom() returns var refs before parse_field() can set any.