Linus,

tracing fixes for v7.1:

- Avoid NULL return from hist_field_name()

  The function hist_field_name() is directly passed to a strcat()
  which does not handle "NULL" characters. Return a zero length
  string when size is greater than the limit.

  This is used only to output already created histograms and no
  field currently is greater than the limit. But it should still
  not return NULL.

- Do not call map->ops->elt_free() on allocation failure

  When elt_alloc() fails, it should not call the map->ops->elt_free()
  function if it exists, as that function may not be able to handle
  the free on allocation failures. The ->elt_free() should only be
  called when elt_alloc() succeeds.


Please pull the latest trace-v7.1-rc4 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.1-rc4

Tag SHA1: 29687dffda8036a4a5d37fc65205c44189c81a80
Head SHA1: 8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03


David Carlier (1):
      tracing: Avoid NULL return from hist_field_name() on truncation

Masami Hiramatsu (Google) (1):
      tracing: Do not call map->ops->elt_free() if elt_alloc() fails

----
 kernel/trace/trace_events_hist.c |  6 ++----
 kernel/trace/tracing_map.c       | 17 +++++++++++++----
 2 files changed, 15 insertions(+), 8 deletions(-)
---------------------------
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 0dbbf6cca9bc..eb2c2bc8bc3d 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1369,10 +1369,8 @@ static const char *hist_field_name(struct hist_field *field,
 			len = snprintf(full_name, sizeof(full_name), fmt,
 				       field->system, field->event_name,
 				       field->name);
-			if (len >= sizeof(full_name))
-				return NULL;
-
-			field_name = full_name;
+			if (len < sizeof(full_name))
+				field_name = full_name;
 		} else
 			field_name = field->name;
 	} else if (field->flags & HIST_FIELD_FL_TIMESTAMP)
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index bf1a507695b6..0dd7927df22a 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -386,13 +386,11 @@ static void tracing_map_elt_init_fields(struct tracing_map_elt *elt)
 	}
 }
 
-static void tracing_map_elt_free(struct tracing_map_elt *elt)
+static void __tracing_map_elt_free(struct tracing_map_elt *elt)
 {
 	if (!elt)
 		return;
 
-	if (elt->map->ops && elt->map->ops->elt_free)
-		elt->map->ops->elt_free(elt);
 	kfree(elt->fields);
 	kfree(elt->vars);
 	kfree(elt->var_set);
@@ -400,6 +398,17 @@ static void tracing_map_elt_free(struct tracing_map_elt *elt)
 	kfree(elt);
 }
 
+static void tracing_map_elt_free(struct tracing_map_elt *elt)
+{
+	if (!elt)
+		return;
+
+	/* Only objects initialized with alloc_elt() should be passed to free_elt().*/
+	if (elt->map->ops && elt->map->ops->elt_free)
+		elt->map->ops->elt_free(elt);
+	__tracing_map_elt_free(elt);
+}
+
 static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map)
 {
 	struct tracing_map_elt *elt;
@@ -444,7 +453,7 @@ static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map)
 	}
 	return elt;
  free:
-	tracing_map_elt_free(elt);
+	__tracing_map_elt_free(elt);
 
 	return ERR_PTR(err);
 }

The pull request you sent on Thu, 21 May 2026 18:08:03 -0400:

> git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace-v7.1-rc4

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/23884007afe901352349e709e33eb19373a842d7

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html