Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfb4a6f2 authored by Tomas Bortoli's avatar Tomas Bortoli Committed by Steven Rostedt (VMware)
Browse files

tracing: Avoid memory leak in predicate_parse() 

In case of errors, predicate_parse() goes to the out_free label
to free memory and to return an error code.

However, predicate_parse() does not free the predicates of the
temporary prog_stack array, thence leaking them.

Link: http://lkml.kernel.org/r/20190528154338.29976-1-tomasbortoli@gmail.com



Cc: stable@vger.kernel.org
Fixes: 80765597 ("tracing: Rewrite filter logic to be simpler and faster")
Reported-by: default avatar <syzbot+6b8e0fb820e570c59e19@syzkaller.appspotmail.com>
Signed-off-by: default avatarTomas Bortoli <tomasbortoli@gmail.com>
[ Added protection around freeing prog_stack[i].pred ]
Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
parent 0c97bf86

kernel/trace/trace_events_filter.c

+6 −2
Original line number Diff line number Diff line
@@ -428,7 +428,7 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, 
	op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);

	if (!op_stack)

		return ERR_PTR(-ENOMEM);

	prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);

	prog_stack = kcalloc(nr_preds, sizeof(*prog_stack), GFP_KERNEL);

	if (!prog_stack) {

		parse_error(pe, -ENOMEM, 0);

		goto out_free;
@@ -579,7 +579,11 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, 
out_free:

	kfree(op_stack);

	kfree(inverts);

	if (prog_stack) {

		for (i = 0; prog_stack[i].pred; i++)

			kfree(prog_stack[i].pred);

		kfree(prog_stack);

	}

	return ERR_PTR(ret);

}