[PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

[PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

[Masami Hiramatsu (Google)]

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
fails), execution jumps to fail_free_reader.

While __free(kfree) automatically frees the outer cpu_buffer structure
at scope exit, kfree(cpu_buffer) does not recursively free nested heap
pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.

Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
fail_free_reader error unwinding path when cpu_buffer->remote is set.

Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 kernel/trace/ring_buffer.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 78d3875a47a5..03f6baf6a5f5 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2599,6 +2599,8 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
 	return_ptr(cpu_buffer);
 
  fail_free_reader:
+	if (cpu_buffer->remote)
+		kfree(cpu_buffer->subbuf_ids);
 	free_buffer_page(cpu_buffer->reader_page);
 
 	return NULL;

Re: [PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

[Vincent Donnefort]

On Thu, Jul 30, 2026 at 04:01:51PM +0900, Masami Hiramatsu (Google) wrote:
> From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
> kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
> fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
> fails), execution jumps to fail_free_reader.
> 
> While __free(kfree) automatically frees the outer cpu_buffer structure
> at scope exit, kfree(cpu_buffer) does not recursively free nested heap
> pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.
> 
> Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
> fail_free_reader error unwinding path when cpu_buffer->remote is set.
> 
> Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
> Assisted-by: Antigravity:gemini-3.6-flash
> Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
>  kernel/trace/ring_buffer.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 78d3875a47a5..03f6baf6a5f5 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -2599,6 +2599,8 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
>  	return_ptr(cpu_buffer);
>  
>   fail_free_reader:
> +	if (cpu_buffer->remote)
> +		kfree(cpu_buffer->subbuf_ids);

alloc_cpu_buffer() being kzalloc, I suppose here we could just unconditionally
call kfree(cpu_buffer->subbuf_ids) ?

>  	free_buffer_page(cpu_buffer->reader_page);
>  
>  	return NULL;
> 

-- 
Vincent

Re: [PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

[Steven Rostedt]

On Thu, 30 Jul 2026 09:13:08 +0100
Vincent Donnefort <vdonnefort@google.com> wrote:

> > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> > index 78d3875a47a5..03f6baf6a5f5 100644
> > --- a/kernel/trace/ring_buffer.c
> > +++ b/kernel/trace/ring_buffer.c
> > @@ -2599,6 +2599,8 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
> >  	return_ptr(cpu_buffer);
> >  
> >   fail_free_reader:
> > +	if (cpu_buffer->remote)
> > +		kfree(cpu_buffer->subbuf_ids);  
> 
> alloc_cpu_buffer() being kzalloc, I suppose here we could just unconditionally
> call kfree(cpu_buffer->subbuf_ids) ?

Agreed. This also removes the coupling between the freeing of subbuf_ids
and it being a remote (in case something else decides to use it).

-- Steve


> 
> >  	free_buffer_page(cpu_buffer->reader_page);
> >  
> >  	return NULL;
> >