From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4368014EC73 for ; Sat, 11 Jul 2026 01:20:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783732854; cv=none; b=jZWGn6ZT7IVq99mmv85AF2Xc8e3NUz9EigO2jf0NP7GFNYf24S7Ool0PcvewhiMSuPfWr6E2VF7DKJirmdjmWSFhmTLmVTIfiNHIJyYNMnWn7J7Kznmshk5tVWCrCiD1ABzLdydaoVFhD86FTZTmSWsGIn1z5fDetks2kyQ+ZJ4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783732854; c=relaxed/simple; bh=YauyptkTeUDKvDQCcWL6r8DBpE9+cqDxI2PBgQovQ+I=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=I18NivYc7HL5f0pLZ6JhXD/KtSi8EM+dUBwaYMqzvpXy3YV+mYT63ywk8t2Pn3JpPE+2XRVKsn0NyEPHnpqyZ9wg6b5EY6TYgpx8HKAUXhXPzyFQ0cqrGGBmbKz+OmGmPWY7/oRZ/hWc/R4g610875eNOMOvCp0hftvOpH+CdaA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CMjMbsOz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CMjMbsOz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C05E1F00A3F; Sat, 11 Jul 2026 01:20:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783732853; bh=omgMi1ancET8Y9ZLxyOMCOZ44wdKZ/T7aSYxRrzUIk0=; h=Date:From:To:Cc:Subject:References; b=CMjMbsOzTd+LUYOw/nYBrhZ7KhgyGwLoNoAoull5WQqqMvHfA8It+LuMy0PbL8Kho 2ncGVXhNUks0rbjYJG2ZHkTrJiswS4BpW8pJUaIx2jTYuZs2gx4WvJEP1LFvlpcGJz sUtGm8LDP+uwks1NF+RawRzp084oz5ngEdvRmTooTWgEYdH+4f0E8Y6YvQtIQ6Wrm1 GaYc3Wl41tqmo1Ww+M7xXNh8Bvlrzx3JbypoLEWDB4t3MqCG3LxjSzraX+sqrKifp9 iYFfbq2o0xAvctX6+YrBH71qjAIG9XTInc6H6daYdu4Ovpyy3mqrUsPRHxN8eeF7Fc hRk22bx2YlMcQ== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wiMOt-00000002F31-43ST; Fri, 10 Jul 2026 21:21:03 -0400 Message-ID: <20260711012103.813178146@kernel.org> User-Agent: quilt/0.69 Date: Fri, 10 Jul 2026 21:20:42 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Sashiko , Vincent Donnefort Subject: [for-linus][PATCH 2/4] tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path References: <20260711012040.762290323@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 From: Vincent Donnefort If page allocation fails in trace_remote_alloc_buffer(), desc->nr_cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb_desc will not be freed in trace_remote_free_buffer(). Increment desc->nr_cpus as soon as the first allocation for the current CPU has succeeded. Link: https://patch.msgid.link/20260709160017.1729517-2-vdonnefort@google.com Fixes: 96e43537af54 ("tracing: Introduce trace remotes") Reported-by: Sashiko Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/trace_remote.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index 2a6cc000ec98..d48042239d58 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -1006,6 +1006,8 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size, if (!rb_desc->meta_va) goto err; + desc->nr_cpus++; + for (id = 0; id < nr_pages; id++) { rb_desc->page_va[id] = (unsigned long)__get_free_page(GFP_KERNEL); if (!rb_desc->page_va[id]) @@ -1013,7 +1015,6 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size, rb_desc->nr_page_va++; } - desc->nr_cpus++; desc->struct_len += offsetof(struct ring_buffer_desc, page_va); desc->struct_len += struct_size(rb_desc, page_va, rb_desc->nr_page_va); rb_desc = __next_ring_buffer_desc(rb_desc); -- 2.53.0