Commit c24be24a authored by Miaoqian Lin's avatar Miaoqian Lin Committed by Steven Rostedt (VMware)
Browse files

tracing: Fix possible memory leak in __create_synth_event() error path 

There's error paths in __create_synth_event() after the argv is allocated
that fail to free it. Add a jump to free it when necessary.

Link: https://lkml.kernel.org/r/20211209024317.11783-1-linmq006@gmail.com



Suggested-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: default avatarMiaoqian Lin <linmq006@gmail.com>
[ Fixed up the patch and change log ]
Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
parent e1067a07

kernel/trace/trace_events_synth.c

+6 −5
Original line number Diff line number Diff line
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) 
						  argv + consumed, &consumed,

						  &field_version);

			if (IS_ERR(field)) {

				argv_free(argv);

				ret = PTR_ERR(field);

				goto err;

				goto err_free_arg;

			}



			/*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields) 
			if (cmd_version > 1 && n_fields_this_loop >= 1) {

				synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));

				ret = -EINVAL;

				goto err;

				goto err_free_arg;

			}



			fields[n_fields++] = field;

			if (n_fields == SYNTH_FIELDS_MAX) {

				synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);

				ret = -EINVAL;

				goto err;

				goto err_free_arg;

			}



			n_fields_this_loop++;

		}

		argv_free(argv);



		if (consumed < argc) {

			synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields) 
			goto err;

		}



		argv_free(argv);

	}



	if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields) 
	kfree(saved_fields);



	return ret;

 err_free_arg:

	argv_free(argv);

 err:

	for (i = 0; i < n_fields; i++)

		free_synth_field(fields[i]);