Some __create_synth_event() error paths run after parse_synth_field() 
succeeds but before the field is stored in fields[]. The common cleanup 
then misses the field. Free it before freeing argv.

Signed-off-by: Yu Peng <[email protected]>
---
 kernel/trace/trace_events_synth.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_events_synth.c 
b/kernel/trace/trace_events_synth.c
index e6871230bde96..cdd5b93328358 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -1446,13 +1446,13 @@ static int __create_synth_event(const char *name, const 
char *raw_fields)
                        if (cmd_version > 1 && n_fields_this_loop >= 1) {
                                synth_err(SYNTH_ERR_INVALID_CMD, 
errpos(field_str));
                                ret = -EINVAL;
-                               goto err_free_arg;
+                               goto err_free_field;
                        }
 
                        if (n_fields == SYNTH_FIELDS_MAX) {
                                synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
                                ret = -EINVAL;
-                               goto err_free_arg;
+                               goto err_free_field;
                        }
                        fields[n_fields++] = field;
 
@@ -1491,6 +1491,8 @@ static int __create_synth_event(const char *name, const 
char *raw_fields)
        kfree(saved_fields);
 
        return ret;
+ err_free_field:
+       free_synth_field(field);
  err_free_arg:
        argv_free(argv);
  err:
-- 
2.43.0


Reply via email to