Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1721411

[PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false
Date 2017-08-28 11:20 +0200
Message-ID <ujon9-3MV-59@gated-at.bofh.it> (permalink)
References <ujnhn-38X-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (VMware) <rostedt@goodmis.org>

commit 8b0db1a5bdfcee0dbfa89607672598ae203c9045 upstream.

Performing the following task with kmemleak enabled:

 # cd /sys/kernel/tracing/events/irq/irq_handler_entry/
 # echo 'enable_event:kmem:kmalloc:3 if irq >' > trigger
 # echo 'enable_event:kmem:kmalloc:3 if irq > 31' > trigger
 # echo scan > /sys/kernel/debug/kmemleak
 # cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8800b9290308 (size 32):
  comm "bash", pid 1114, jiffies 4294848451 (age 141.139s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81cef5aa>] kmemleak_alloc+0x4a/0xa0
    [<ffffffff81357938>] kmem_cache_alloc_trace+0x158/0x290
    [<ffffffff81261c09>] create_filter_start.constprop.28+0x99/0x940
    [<ffffffff812639c9>] create_filter+0xa9/0x160
    [<ffffffff81263bdc>] create_event_filter+0xc/0x10
    [<ffffffff812655e5>] set_trigger_filter+0xe5/0x210
    [<ffffffff812660c4>] event_enable_trigger_func+0x324/0x490
    [<ffffffff812652e2>] event_trigger_write+0x1a2/0x260
    [<ffffffff8138cf87>] __vfs_write+0xd7/0x380
    [<ffffffff8138f421>] vfs_write+0x101/0x260
    [<ffffffff8139187b>] SyS_write+0xab/0x130
    [<ffffffff81cfd501>] entry_SYSCALL_64_fastpath+0x1f/0xbe
    [<ffffffffffffffff>] 0xffffffffffffffff

The function create_filter() is passed a 'filterp' pointer that gets
allocated, and if "set_str" is true, it is up to the caller to free it, even
on error. The problem is that the pointer is not freed by create_filter()
when set_str is false. This is a bug, and it is not up to the caller to free
the filter on error if it doesn't care about the string.

Link: http://lkml.kernel.org/r/1502705898-27571-2-git-send-email-chuhu@redhat.com

Fixes: 38b78eb85 ("tracing: Factorize filter creation")
Reported-by: Chunyu Hu <chuhu@redhat.com>
Tested-by: Chunyu Hu <chuhu@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/trace_events_filter.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1959,6 +1959,10 @@ static int create_filter(struct trace_ev
 		if (err && set_str)
 			append_filter_err(ps, filter);
 	}
+	if (err && !set_str) {
+		free_event_filter(filter);
+		filter = NULL;
+	}
 	create_filter_finish(ps);
 
 	*filterp = filter;

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 90/99] iio: magnetometer: st_magn: fix status register address for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 23/99] irda: do not leak initialized list.dev to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 40/99] ALSA: firewire: fix NULL pointer dereference when releasing uninitialized data of iso-resource Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 38/99] ALSA: core: Fix unexpected error at replacing user TLV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 20/99] ipv6: repair fib6 tree in failure case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 44/99] ARCv2: PAE40: set MSB even if !CONFIG_ARC_HAS_PAE40 but PAE exists in SoC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 17/99] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 68/99] cifs: Fix df output for users with quota limits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 11/99] net: igmp: Use ingress interface rather than vrf device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 18/99] tipc: fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 13/99] ptr_ring: use kmalloc_array() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 36/99] KVM: x86: block guest protection keys unless the host has them enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 31/99] Input: ALPS - fix two-finger scroll breakage in right side on ALPS touchpad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 10/99] bpf: fix bpf_trace_printk on 32 bit archs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:10 +0200
  [PATCH 4.12 93/99] iommu: Fix wrong freeing of iommu_device->dev Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 75/99] timers: Fix excessive granularity of new timers after a nohz idle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 79/99] netfilter: nat: fix src map lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 77/99] net: sunrpc: svcsock: fix NULL-pointer exception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 99/99] powerpc/mm: Ensure cpumask update is ordered Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 81/99] Bluetooth: hidp: fix possible might sleep error in hidp_session_thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 10:20 +0200
  [PATCH 4.12 91/99] iio: magnetometer: st_magn: remove ihl property for LSM303AGR Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 76/99] x86/mm: Fix use-after-free of ldt_struct Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 80/99] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 69/99] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 96/99] ntb: transport shouldnt disable link due to bogus values in SPADs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 89/99] iio: hid-sensor-trigger: Fix the race with user space powering up sensors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 73/99] ftrace: Check for null ret_stack on profile function graph entry function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 95/99] ntb: ntb_test: ensure the link is up before trying to configure the mws Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 63/99] tracing: Missing error code in tracer_alloc_buffers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 82/99] Bluetooth: cmtp: fix possible might sleep error in cmtp_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 94/99] Clarify (and fix) MAX_LFS_FILESIZE macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 74/99] perf/core: Fix group {cpu,task} validation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 71/99] ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 35/99] KVM, pkeys: do not use PKRU value in vcpu->arch.guest_fpu.state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 83/99] Bluetooth: bnep: fix possible might sleep error in bnep_session Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 72/99] virtio_pci: fix cpu affinity support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 97/99] ACPI: APD: Fix HID for Hisilicon Hip07/08 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 87/99] ANDROID: binder: fix proc->tsk check. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 37/99] ALSA: usb-audio: Add delay quirk for H650e/Jabra 550a USB headsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 85/99] binder: use group leader instead of open thread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 78/99] netfilter: expect: fix crash when putting uninited expectation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 98/99] ACPI: EC: Fix regression related to wrong ECDT initialization order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 70/99] nfsd: Limit end of page list when decoding NFSv4 WRITE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 39/99] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:10 +0200
  [PATCH 4.12 33/99] KVM: s390: sthyi: fix specification exception detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 64/99] tracing: Fix kmemleak in tracing_map_array_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 52/99] arm64: fpsimd: Prevent registers leaking across exec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 03/99] bonding: ratelimit failed speed/duplex update warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 07/99] ipv4: fix NULL dereference in free_fib_info_rcu() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 47/99] dax: fix deadlock due to misaligned PMD faults Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 57/99] drm/atomic: If the atomic check fails, return its value first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 45/99] PM/hibernate: touch NMI watchdog when creating snapshot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 43/99] ARCv2: PAE40: Explicitly set MSB counterpart of SLC region ops addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 08/99] net_sched/sfq: update hierarchical backlog when drop packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 61/99] ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 48/99] i2c: designware: Fix system suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 66/99] RDMA/uverbs: Initialize cq_context appropriately Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 30/99] Input: elan_i2c - add ELAN0602 ACPI ID to support Lenovo Yoga310 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 46/99] mm, shmem: fix handling /sys/kernel/mm/transparent_hugepage/shmem_enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 60/99] Revert "drm/amdgpu: fix vblank_time when displays are off" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 32/99] KVM: s390: sthyi: fix sthyi inline assembly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 09/99] net_sched: remove warning from qdisc_hash_add Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 65/99] tracing: Fix freeing of filter in create_filter() when set_str is false Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 41/99] ALSA: firewire-motu: destroy stream data surely at failure of card initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 05/99] dccp: purge write queue in dccp_destroy_sock() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 42/99] ARCv2: SLC: Make sure busy bit is set properly for region ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 49/99] mm/madvise.c: fix freeing of locked page with MADV_FREE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:20 +0200
  [PATCH 4.12 21/99] tcp: when rearming RTO, if RTO time is in past then fire RTO ASAP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 12/99] openvswitch: fix skb_panic due to the incorrect actions attrlen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 16/99] tun: handle register_netdevice() failures properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 24/99] net: sched: fix NULL pointer dereference when action calls some targets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 02/99] bonding: require speed/duplex only for 802.3ad, alb and tlb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 28/99] bpf/verifier: fix min/max handling in BPF_SUB Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 26/99] bpf, verifier: add additional patterns to evaluate_reg_imm_alu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 14/99] ipv4: better IP_MAX_MTU enforcement Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  [PATCH 4.12 19/99] ipv6: reset fn->rr_ptr when replacing route Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-28 11:30 +0200
  Re: [PATCH 4.12 00/99] 4.12.10-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-28 21:50 +0200
    Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200
  Re: [PATCH 4.12 00/99] 4.12.10-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-29 02:20 +0200
    Re: [PATCH 4.12 00/99] 4.12.10-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-29 07:00 +0200

csiph-web