[PATCH v2] tracing/synthetic: Free type string on error path

[PATCH v2] tracing/synthetic: Free type string on error path

[Yu Peng]

parse_synth_field() builds a "__data_loc ..." type string before
assigning it to field->type. If the seq_buf check fails, the temporary
string is not owned by field and is leaked. Free it before leaving.

Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Yu Peng <pengyu@kylinos.cn>
---
Changes in v2:
- Use __free(kfree) and no_free_ptr() as suggested by Steven.

 kernel/trace/trace_events_synth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
index e6871230bde96..ad2e70258291b 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
 	} else if (size == 0) {
 		if (synth_field_is_string(field->type) ||
 		    synth_field_is_stack(field->type)) {
-			char *type;
+			char *type __free(kfree) = NULL;
 
 			len = sizeof("__data_loc ") + strlen(field->type) + 1;
 			type = kzalloc(len, GFP_KERNEL);
@@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
 			s.buffer[s.len] = '\0';
 
 			kfree(field->type);
-			field->type = type;
+			field->type = no_free_ptr(type);
 
 			field->is_dynamic = true;
 			size = sizeof(u64);
-- 
2.43.0

Re: [PATCH v2] tracing/synthetic: Free type string on error path

[Steven Rostedt]

On Tue,  7 Jul 2026 21:24:17 +0800
Yu Peng <pengyu@kylinos.cn> wrote:

> parse_synth_field() builds a "__data_loc ..." type string before
> assigning it to field->type. If the seq_buf check fails, the temporary
> string is not owned by field and is leaked. Free it before leaving.
> 
> Suggested-by: Steven Rostedt <rostedt@goodmis.org>
> Signed-off-by: Yu Peng <pengyu@kylinos.cn>
> ---
> Changes in v2:
> - Use __free(kfree) and no_free_ptr() as suggested by Steven.
> 
>  kernel/trace/trace_events_synth.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
> index e6871230bde96..ad2e70258291b 100644
> --- a/kernel/trace/trace_events_synth.c
> +++ b/kernel/trace/trace_events_synth.c
> @@ -828,7 +828,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
>  	} else if (size == 0) {
>  		if (synth_field_is_string(field->type) ||
>  		    synth_field_is_stack(field->type)) {
> -			char *type;
> +			char *type __free(kfree) = NULL;

Ah, we can't do this here.

(Sashiko pointed this out: https://sashiko.dev/#/patchset/20260707132417.2193412-1-pengyu%40kylinos.cn )

>  
>  			len = sizeof("__data_loc ") + strlen(field->type) + 1;
>  			type = kzalloc(len, GFP_KERNEL);

Because after this code we have:

			type = kzalloc(len, GFP_KERNEL);
			if (!type)
				goto free;

Which jumps out of the if block, and that will break the cleanup.

I'll take you original version for now.

-- Steve


> @@ -844,7 +844,7 @@ static struct synth_field *parse_synth_field(int argc, char **argv,
>  			s.buffer[s.len] = '\0';
>  
>  			kfree(field->type);
> -			field->type = type;
> +			field->type = no_free_ptr(type);
>  
>  			field->is_dynamic = true;
>  			size = sizeof(u64);