From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCF83CA4E for ; Sat, 1 Aug 2026 00:36:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=216.40.44.15 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785544579; cv=none; b=DAacOWIZKSntphUphCOZBIZ9HKaXXkv301vAyVDjw8HdFC2gR2NN6LDveZwsYtS+qmWhf3KhespdhMlcGseVqAu+UR8fzsVMms096ojGoppRjC3i6uB88R3m78qyWEik8Fu83XQ7yYh37o/tiPIx7WvThq9u1stFJtIviPymL9Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785544579; c=relaxed/simple; bh=U6ErMFCYH7VEYvcTvWCg+Zu45jTs/HZUYBVGvXb9NDM=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=OcJc4NYw7zcv4aIJ8uOFNGrR+onFqJQ4GDWoa7T12hvRc5sgeAA3g74bNwYcUQH3BnCUqb6ZIfMw/ImLcB2zznNUL3MHr4rQNJn3nDv+ZSVbh6f4+zTq9d0NBlaUI9qiC01GmI6TOwkB+0HJX5CImhF3fwtgEPw2vK0/+BuaZXI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org; spf=pass smtp.mailfrom=goodmis.org; arc=none smtp.client-ip=216.40.44.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=goodmis.org Received: from omf20.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 0BFAF80199; Sat, 1 Aug 2026 00:36:14 +0000 (UTC) Received: from [HIDDEN] (Authenticated sender: rostedt@goodmis.org) by omf20.hostedemail.com (Postfix) with ESMTPA id 9414D20026; Sat, 1 Aug 2026 00:36:12 +0000 (UTC) Date: Fri, 31 Jul 2026 20:36:11 -0400 From: Steven Rostedt To: LKML Cc: Masami Hiramatsu , Mathieu Desnoyers Subject: [for-linus][PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path Message-ID: <20260731203611.680cbc68@robin> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-redhat-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Stat-Signature: tjtmicx5fpgiuon99pcg97jaz757ehoj X-Rspamd-Server: rspamout02 X-Rspamd-Queue-Id: 9414D20026 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Session-ID: U2FsdGVkX19b7GB8LDjoDnvRq7yXS1+B4XPNdd7qFQU= X-HE-Tag: 1785544572-798624 X-HE-Meta: U2FsdGVkX19TpGUuGbMcHoGu3JQwjtn9XGz7P+/1U4UWUVaHP4b7+BQ1K72OBmLQ2+kmHbptQxeclPSJyp9GO98iVuO8QqojRwoW1rNMf1RXsyuhG76DfMnZOM8hY4hmzge55Ivtypxw46ZDNvnCS7MZutcDAZHvNOVKTgl1uKcFhZBZD0xLOyMcPq/jITwi3wlk/Q1MGRYXCkWLHPd6s+aP53HnIBR/xXbKKdeSTtr5CzOYKS+uaD4VPKYfS5qyCsS6alRMEZ+ORcMCPlo7CWdSe7MxcD6NzP6H/sGYsmJQ+uaYmvZ6A9WLNvvq9+6sBti6zBOrI+BV/pJ2yM5ct+Whc1EYnlLUq6e4ftgNULexXJ2JFmTAG+eJ1a739ta2aV7bffrK4CF/pwyY1/i6aZWtcspMXyqbq3lUkQHu3rU39nXkYuEQcCWXVdCIQ+69oihuyZIabA5UXMVrWi+OqVNXo3RN5yR0i88YnmvIXYuVs+pgEGFE2ZspCu/InSIY tracing fix for 7.2: - Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer() Remote buffers allocate a subbuf_ids array. If the allocator function fails after it is allocated, it does not free it, resulting in a memory leak. git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace/fixes Head SHA1: 260b20d9b78bf002f89088fb62d60e8dee98f6f8 Masami Hiramatsu (Google) (1): ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path ---- kernel/trace/ring_buffer.c | 1 + 1 file changed, 1 insertion(+) --------------------------- commit 260b20d9b78bf002f89088fb62d60e8dee98f6f8 Author: Masami Hiramatsu (Google) Date: Fri Jul 31 23:16:46 2026 +0900 ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages() fails), execution jumps to fail_free_reader. While __free(kfree) automatically frees the outer cpu_buffer structure at scope exit, kfree(cpu_buffer) does not recursively free nested heap pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak. Fix this by explicitly freeing cpu_buffer->subbuf_ids in the fail_free_reader error unwinding path when cpu_buffer->remote is set. Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2 Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Vincent Donnefort Signed-off-by: Steven Rostedt diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 78d3875a47a5..8e2485bb3aa8 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -2599,6 +2599,7 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu) return_ptr(cpu_buffer); fail_free_reader: + kfree(cpu_buffer->subbuf_ids); free_buffer_page(cpu_buffer->reader_page); return NULL;