Before applying the __free annotation, the original version goes to
label `fail_address_parse`, and does not call function
`free_trace_uprobe` on pointer `tu`. However, after the change, the
function will be called whenever the function returns. This makes the
error value returned by `alloc_trace_uprobe` get freed.

This patch fixes this issue by adding the check for error value in the
__free function definition.

Found by Clang Static Analyzer (my own development fork
https://github.com/Snape3058/llvm-patch-revision/tree/cleanup).

	warning: Argument to 'kfree()' is a constant address
	(18446744073709551604), which is not memory allocated by
	'malloc()' [unix.Malloc]

Fixes: 8b658df20658 ("tracing: uprobes: Cleanup __trace_uprobe_create() with __free()")
Signed-off-by: Ella Ma <alansnape3058@gmail.com>
---
 kernel/trace/trace_uprobe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index c274346853d1..ccbdc96e5578 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -533,7 +533,7 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
 	return ret;
 }
 
-DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *, if (_T) free_trace_uprobe(_T))
+DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *, if (!IS_ERR_OR_NULL(_T)) free_trace_uprobe(_T))
 
 /*
  * Argument syntax:
-- 
2.34.1

On Mon, 17 Aug 2026 10:30:14 +0200
Ella Ma <alansnape3058@gmail.com> wrote:

> Before applying the __free annotation, the original version goes to
> label `fail_address_parse`, and does not call function
> `free_trace_uprobe` on pointer `tu`. However, after the change, the
> function will be called whenever the function returns. This makes the
> error value returned by `alloc_trace_uprobe` get freed.
> 
> This patch fixes this issue by adding the check for error value in the
> __free function definition.
> 
> Found by Clang Static Analyzer (my own development fork
> https://github.com/Snape3058/llvm-patch-revision/tree/cleanup).
> 
> 	warning: Argument to 'kfree()' is a constant address
> 	(18446744073709551604), which is not memory allocated by
> 	'malloc()' [unix.Malloc]
> 

Ah, thanks for the patch. Actually Andi sent the similar fix.

https://lore.kernel.org/all/20260831150651.1134594-2-ak@kernel.org/

which is more optimized one (remove redundant NULL check and
allow passing ERRPTR to free_trace_uprobe().)

Thanks,

> Fixes: 8b658df20658 ("tracing: uprobes: Cleanup __trace_uprobe_create() with __free()")
> Signed-off-by: Ella Ma <alansnape3058@gmail.com>
> ---
>  kernel/trace/trace_uprobe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
> index c274346853d1..ccbdc96e5578 100644
> --- a/kernel/trace/trace_uprobe.c
> +++ b/kernel/trace/trace_uprobe.c
> @@ -533,7 +533,7 @@ static int register_trace_uprobe(struct trace_uprobe *tu)
>  	return ret;
>  }
>  
> -DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *, if (_T) free_trace_uprobe(_T))
> +DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *, if (!IS_ERR_OR_NULL(_T)) free_trace_uprobe(_T))
>  
>  /*
>   * Argument syntax:
> -- 
> 2.34.1
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>