mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
To: Steven Rostedt <rostedt@goodmis.org>,
	Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
	linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org
Subject: [PATCH v2 09/13] tracing/uprobes: Fix memory leak of tail in __trace_uprobe_create()
Date: Thu, 12 Nov 2026 10:28:00 +0900	[thread overview]
Message-ID: <179444688044.345731.12892767299503363577.stgit@devnote2> (raw)
In-Reply-To: <179444679892.345731.5271591537517106679.stgit@devnote2>

From: Masami Hiramatsu (Google) <mhiramat@kernel.org>

When generating a default event name in __trace_uprobe_create(), tail is
allocated with kstrdup() without __free(kfree). If the subsequent
kmalloc() for buf fails, the function returns -ENOMEM immediately and
leaks tail.

Declare tail with __free(kfree) so it is automatically freed on all
exit paths.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/sashiko-outbox-204240@kernel.org/
Fixes: 97e8230f89a3 ("tracing: uprobe-event: Allocate string buffers from heap")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
Changes in v2:
 - Newly added.
---
 kernel/trace/trace_uprobe.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index 14ac52aebe34..fb7991543db7 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -701,7 +701,7 @@ static int __trace_uprobe_create(int argc, const char **argv)
 	}
 
 	if (!event) {
-		char *tail;
+		char *tail __free(kfree) = NULL;
 		char *ptr;
 
 		tail = kstrdup(kbasename(filename), GFP_KERNEL);
@@ -717,7 +717,6 @@ static int __trace_uprobe_create(int argc, const char **argv)
 			return -ENOMEM;
 		snprintf(buf, MAX_EVENT_NAME_LEN, "%c_%s_0x%lx", 'p', tail, offset);
 		event = buf;
-		kfree(tail);
 	}
 
 	argc -= 2;


  parent reply	other threads:[~2026-11-12  1:28 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-12  1:26 [PATCH v2 00/13] tracing/probes: Fix various bugs in dynamic probe events Masami Hiramatsu (Google)
2026-11-12  1:26 ` [PATCH v2 01/13] tracing/probes: Check enabled and busy state before unlinking sibling probes Masami Hiramatsu (Google)
2026-11-12  1:26 ` [PATCH v2 02/13] tracing/probes: Enable newly appended probe when target event is enabled Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 03/13] tracing/probes: Fix BTF bitfield parsing and out-of-bounds buffer write Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 04/13] tracing/probes: Fix missing BTF kind checks in char pointer/array helpers Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 05/13] tracing/eprobe: Fix 1-byte signed field fetch in get_event_field() Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 06/13] tracing/eprobe: Disallow attaching eprobes to fprobe events Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 07/13] tracing/probes: Fix user-space dereference string array store type Masami Hiramatsu (Google)
2026-11-12  1:27 ` [PATCH v2 08/13] tracing/probes: Reject array count on non-dereference string sources Masami Hiramatsu (Google)
2026-11-12  1:28 ` Masami Hiramatsu (Google) [this message]
2026-11-12  1:28 ` [PATCH v2 10/13] tracing/probes: Allow symstr type for function entry arguments in return probes Masami Hiramatsu (Google)
2026-11-12  1:28 ` [PATCH v2 11/13] tracing/probes: Reject empty fetch expression for %pd and %pD Masami Hiramatsu (Google)
2026-11-12  1:28 ` [PATCH v2 12/13] tracing/probes: Validate command prefix in kprobe, uprobe, and eprobe Masami Hiramatsu (Google)
2026-11-12  1:28 ` [PATCH v2 13/13] tracing/probes: Propagate error codes in eprobe and fprobe creation Masami Hiramatsu (Google)

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=179444688044.345731.12892767299503363577.stgit@devnote2 \
    --to=mhiramat@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@efficios.com \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®