History

tracing: Fix possible memory leak in __create_synth_event() error path

There's error paths in __create_synth_event() after the argv is allocated that fail to free it. Add a jump to free it when necessary. Link: https://lkml.kernel.org/r/20211209024317.11783-1-linmq006@gmail.com

Miaoqian Lin committed 4 years ago

Commit c24be241 parent e1067a01 file · +6 −5Browse files

Unified · Split

kernel/trace/trace_events_synth.c+6−5
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1236 unmodified lines
1237 argv + consumed, &consumed,1237 argv + consumed, &consumed,
1238 &field_version);1238 &field_version);
1239 if (IS_ERR(field)) {1239 if (IS_ERR(field)) {
1240 argv_free(argv);
1241 ret = PTR_ERR(field);1240 ret = PTR_ERR(field);
1242 goto err;1241 goto err_free_arg;
1243 }1242 }
1244 1243
1245 /*1244 /*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 16 unmodified lines
1262 if (cmd_version > 1 && n_fields_this_loop >= 1) {1261 if (cmd_version > 1 && n_fields_this_loop >= 1) {
1263 synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));1262 synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));
1264 ret = -EINVAL;1263 ret = -EINVAL;
1265 goto err;1264 goto err_free_arg;
1266 }1265 }
1267 1266
1268 fields[n_fields++] = field;1267 fields[n_fields++] = field;
1269 if (n_fields == SYNTH_FIELDS_MAX) {1268 if (n_fields == SYNTH_FIELDS_MAX) {
1270 synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);1269 synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
1271 ret = -EINVAL;1270 ret = -EINVAL;
1272 goto err;1271 goto err_free_arg;
1273 }1272 }
1274 1273
1275 n_fields_this_loop++;1274 n_fields_this_loop++;
1276 }1275 }
1276 argv_free(argv);
1277 1277
1278 if (consumed < argc) {1278 if (consumed < argc) {
1279 synth_err(SYNTH_ERR_INVALID_CMD, 0);1279 synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1 unmodified line
1281 goto err;1281 goto err;
1282 }1282 }
1283 1283
1284 argv_free(argv);
1285 }1284 }
1286 1285
1287 if (n_fields == 0) {1286 if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 19 unmodified lines
1307 kfree(saved_fields);1306 kfree(saved_fields);
1308 1307
1309 return ret;1308 return ret;
1309 err_free_arg:
1310 argv_free(argv);
1310 err:1311 err:
1311 for (i = 0; i < n_fields; i++)1312 for (i = 0; i < n_fields; i++)
1312 free_synth_field(fields[i]);1313 free_synth_field(fields[i]);