History

tracing: Fix possible memory leak in __create_synth_event() error path

There's error paths in __create_synth_event() after the argv is allocated that fail to free it. Add a jump to free it when necessary. Link: https://lkml.kernel.org/r/20211209024317.11783-1-linmq006@gmail.com

Miaoqian Lin committed 4 years ago

Commit c24be241 parent e1067a01 file · +6 −5Browse files

Showing the changes to kernel (1 of 1 file). Show all

Unified · Split

kernel/trace/trace_events_synth.c+6−5
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1236 unmodified lines
12371237 argv + consumed, &consumed,
12381238 &field_version);
12391239 if (IS_ERR(field)) {
1240− argv_free(argv);
12411240 ret = PTR_ERR(field);
1242− goto err;
1241+ goto err_free_arg;
12431242 }
12441243
12451244 /*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 16 unmodified lines
12621261 if (cmd_version > 1 && n_fields_this_loop >= 1) {
12631262 synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));
12641263 ret = -EINVAL;
1265− goto err;
1264+ goto err_free_arg;
12661265 }
12671266
12681267 fields[n_fields++] = field;
12691268 if (n_fields == SYNTH_FIELDS_MAX) {
12701269 synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
12711270 ret = -EINVAL;
1272− goto err;
1271+ goto err_free_arg;
12731272 }
12741273
12751274 n_fields_this_loop++;
12761275 }
1276+ argv_free(argv);
12771277
12781278 if (consumed < argc) {
12791279 synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 1 unmodified line
12811281 goto err;
12821282 }
12831283
1284− argv_free(argv);
12851284 }
12861285
12871286 if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) · 19 unmodified lines
13071306 kfree(saved_fields);
13081307
13091308 return ret;
1309+ err_free_arg:
1310+ argv_free(argv);
13101311 err:
13111312 for (i = 0; i < n_fields; i++)
13121313 free_synth_field(fields[i]);