Skip to content

Commit 2fa6a01

Browse files
Adrian Huangrostedt
authored andcommitted
tracing: Fix memory leak when reading set_event file
kmemleak reports the following memory leak after reading set_event file: # cat /sys/kernel/tracing/set_event # cat /sys/kernel/debug/kmemleak unreferenced object 0xff110001234449e0 (size 16): comm "cat", pid 13645, jiffies 4294981880 hex dump (first 16 bytes): 01 00 00 00 00 00 00 00 a8 71 e7 84 ff ff ff ff .........q...... backtrace (crc c43abbc): __kmalloc_cache_noprof+0x3ca/0x4b0 s_start+0x72/0x2d0 seq_read_iter+0x265/0x1080 seq_read+0x2c9/0x420 vfs_read+0x166/0xc30 ksys_read+0xf4/0x1d0 do_syscall_64+0x79/0x150 entry_SYSCALL_64_after_hwframe+0x76/0x7e The issue can be reproduced regardless of whether set_event is empty or not. Here is an example about the valid content of set_event. # cat /sys/kernel/tracing/set_event sched:sched_process_fork sched:sched_switch sched:sched_wakeup *:*:mod:trace_events_sample The root cause is that s_next() returns NULL when nothing is found. This results in s_stop() attempting to free a NULL pointer because its parameter is NULL. Fix the issue by freeing the memory appropriately when s_next() fails to find anything. Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://lore.kernel.org/20250220031528.7373-1-ahuang12@lenovo.com Fixes: b355247 ("tracing: Cache ":mod:" events for modules not loaded yet") Signed-off-by: Adrian Huang <ahuang12@lenovo.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
1 parent 57b76be commit 2fa6a01

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

kernel/trace/trace_events.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1591,6 +1591,13 @@ s_next(struct seq_file *m, void *v, loff_t *pos)
15911591
return iter;
15921592
#endif
15931593

1594+
/*
1595+
* The iter is allocated in s_start() and passed via the 'v'
1596+
* parameter. To stop the iterator, NULL must be returned. But
1597+
* the return value is what the 'v' parameter in s_stop() receives
1598+
* and frees. Free iter here as it will no longer be used.
1599+
*/
1600+
kfree(iter);
15941601
return NULL;
15951602
}
15961603

@@ -1667,9 +1674,9 @@ static int s_show(struct seq_file *m, void *v)
16671674
}
16681675
#endif
16691676

1670-
static void s_stop(struct seq_file *m, void *p)
1677+
static void s_stop(struct seq_file *m, void *v)
16711678
{
1672-
kfree(p);
1679+
kfree(v);
16731680
t_stop(m, NULL);
16741681
}
16751682

0 commit comments

Comments
 (0)