tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Merge tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fix from Steven Rostedt:

- Fix possible UAF on error path in filter_free_subsystem_filters()

When freeing a subsystem filter, the filter for the subsystem is
passed in to be freed and all the events within the subsystem will
have their filter freed too. In order to free without waiting for RCU
synchronization, list items are allocated to hold what is going to be
freed to free it via a call_rcu(). If the allocation of these items
fails, it will call the synchronization directly and free after that
(causing a bit of delay for the user).

The subsystem filter is first added to this list and then the filters
for all the events under the subsystem. The bug is if one of the
allocations of the list items for the event filters fail to allocate,
it jumps to the "free_now" label which will free the subsystem
filter, then all the items on the allocated list, and then the event
filters that were not added to the list yet. But because the
subsystem filter was added first, it gets freed twice.

The solution is to add the subsystem filter after the events, and
then if any of the allocations fail it will not try to free any of
them twice

* tag 'trace-v6.16-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Fix filter logic error

Linus Torvalds ded77901 3a3de75a

+7 -7
+7 -7
kernel/trace/trace_events_filter.c
··· 1436 1436 1437 1437 INIT_LIST_HEAD(&head->list); 1438 1438 1439 - item = kmalloc(sizeof(*item), GFP_KERNEL); 1440 - if (!item) 1441 - goto free_now; 1442 - 1443 - item->filter = filter; 1444 - list_add_tail(&item->list, &head->list); 1445 - 1446 1439 list_for_each_entry(file, &tr->events, list) { 1447 1440 if (file->system != dir) 1448 1441 continue; ··· 1446 1453 list_add_tail(&item->list, &head->list); 1447 1454 event_clear_filter(file); 1448 1455 } 1456 + 1457 + item = kmalloc(sizeof(*item), GFP_KERNEL); 1458 + if (!item) 1459 + goto free_now; 1460 + 1461 + item->filter = filter; 1462 + list_add_tail(&item->list, &head->list); 1449 1463 1450 1464 delay_free_filter(head); 1451 1465 return;