Commit ec082d0b978b for kernel

commit ec082d0b978b5fb4c11205ccce63587ac94c74e1
Author: Vincent Donnefort <vdonnefort@google.com>
Date:   Thu Jul 9 17:00:15 2026 +0100

    tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path

    If page allocation fails in trace_remote_alloc_buffer(), desc->nr_cpus
    is not yet incremented for the current CPU. As a consequence, on error,
    half-allocated rb_desc will not be freed in trace_remote_free_buffer().

    Increment desc->nr_cpus as soon as the first allocation for the current
    CPU has succeeded.

    Link: https://patch.msgid.link/20260709160017.1729517-2-vdonnefort@google.com
    Fixes: 96e43537af54 ("tracing: Introduce trace remotes")
    Reported-by: Sashiko <sashiko-bot@kernel.org>
    Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c
index 2a6cc000ec98..d48042239d58 100644
--- a/kernel/trace/trace_remote.c
+++ b/kernel/trace/trace_remote.c
@@ -1006,6 +1006,8 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
 		if (!rb_desc->meta_va)
 			goto err;

+		desc->nr_cpus++;
+
 		for (id = 0; id < nr_pages; id++) {
 			rb_desc->page_va[id] = (unsigned long)__get_free_page(GFP_KERNEL);
 			if (!rb_desc->page_va[id])
@@ -1013,7 +1015,6 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,

 			rb_desc->nr_page_va++;
 		}
-		desc->nr_cpus++;
 		desc->struct_len += offsetof(struct ring_buffer_desc, page_va);
 		desc->struct_len += struct_size(rb_desc, page_va, rb_desc->nr_page_va);
 		rb_desc = __next_ring_buffer_desc(rb_desc);