[for-linus][PATCH] ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

[Steven Rostedt]

tracing fix for 7.2:

- Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer()

  Remote buffers allocate a subbuf_ids array. If the allocator function
  fails after it is allocated, it does not free it, resulting in a
  memory leak.

  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace/fixes

Head SHA1: 260b20d9b78bf002f89088fb62d60e8dee98f6f8


Masami Hiramatsu (Google) (1):
      ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

----
 kernel/trace/ring_buffer.c | 1 +
 1 file changed, 1 insertion(+)
---------------------------
commit 260b20d9b78bf002f89088fb62d60e8dee98f6f8
Author: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
Date:   Fri Jul 31 23:16:46 2026 +0900

    ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path
    
    In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using
    kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation
    fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages()
    fails), execution jumps to fail_free_reader.
    
    While __free(kfree) automatically frees the outer cpu_buffer structure
    at scope exit, kfree(cpu_buffer) does not recursively free nested heap
    pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak.
    
    Fix this by explicitly freeing cpu_buffer->subbuf_ids in the
    fail_free_reader error unwinding path when cpu_buffer->remote is set.
    
    Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2
    Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
    Assisted-by: Antigravity:gemini-3.6-flash
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
    Reviewed-by: Vincent Donnefort <vdonnefort@xxxxxxxxxx>
    Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 78d3875a47a5..8e2485bb3aa8 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2599,6 +2599,7 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
 	return_ptr(cpu_buffer);
 
  fail_free_reader:
+	kfree(cpu_buffer->subbuf_ids);
 	free_buffer_page(cpu_buffer->reader_page);
 
 	return NULL;