[for-linus][PATCH] tracing: Fix possible memory leak in __create_synth_event() error path

[Steven Rostedt]

Tracing update for 5.16:

- Fix memory leak in error path of __create_synth_event()

Miaoqian Lin (1):
      tracing: Fix possible memory leak in __create_synth_event() error path

----
 kernel/trace/trace_events_synth.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
---------------------------
commit c24be24aed405d64ebcf04526614c13b2adfb1d2
Author: Miaoqian Lin <linmq006@xxxxxxxxx>
Date:   Thu Dec 9 02:43:17 2021 +0000

    tracing: Fix possible memory leak in __create_synth_event() error path
    
    There's error paths in __create_synth_event() after the argv is allocated
    that fail to free it. Add a jump to free it when necessary.
    
    Link: https://lkml.kernel.org/r/20211209024317.11783-1-linmq006@xxxxxxxxx
    
    Suggested-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>
    Signed-off-by: Miaoqian Lin <linmq006@xxxxxxxxx>
    [ Fixed up the patch and change log ]
    Signed-off-by: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>

diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
index 22db3ce95e74..ca9c13b2ecf4 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 						  argv + consumed, &consumed,
 						  &field_version);
 			if (IS_ERR(field)) {
-				argv_free(argv);
 				ret = PTR_ERR(field);
-				goto err;
+				goto err_free_arg;
 			}
 
 			/*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 			if (cmd_version > 1 && n_fields_this_loop >= 1) {
 				synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));
 				ret = -EINVAL;
-				goto err;
+				goto err_free_arg;
 			}
 
 			fields[n_fields++] = field;
 			if (n_fields == SYNTH_FIELDS_MAX) {
 				synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
 				ret = -EINVAL;
-				goto err;
+				goto err_free_arg;
 			}
 
 			n_fields_this_loop++;
 		}
+		argv_free(argv);
 
 		if (consumed < argc) {
 			synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 			goto err;
 		}
 
-		argv_free(argv);
 	}
 
 	if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 	kfree(saved_fields);
 
 	return ret;
+ err_free_arg:
+	argv_free(argv);
  err:
 	for (i = 0; i < n_fields; i++)
 		free_synth_field(fields[i]);