Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da32e030 authored by Tomas Bortoli's avatar Tomas Bortoli Committed by Greg Kroah-Hartman
Browse files

tracing: Avoid memory leak in predicate_parse() 

commit dfb4a6f2191a80c8b790117d0ff592fd712d3296 upstream.

In case of errors, predicate_parse() goes to the out_free label
to free memory and to return an error code.

However, predicate_parse() does not free the predicates of the
temporary prog_stack array, thence leaking them.

Link: http://lkml.kernel.org/r/20190528154338.29976-1-tomasbortoli@gmail.com



Cc: stable@vger.kernel.org
Fixes: 80765597 ("tracing: Rewrite filter logic to be simpler and faster")
Reported-by: default avatar <syzbot+6b8e0fb820e570c59e19@syzkaller.appspotmail.com>
Signed-off-by: default avatarTomas Bortoli <tomasbortoli@gmail.com>
[ Added protection around freeing prog_stack[i].pred ]
Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9756c7e0

kernel/trace/trace_events_filter.c

+6 −2
Original line number Diff line number Diff line
@@ -427,7 +427,7 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, 
	op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);

	if (!op_stack)

		return ERR_PTR(-ENOMEM);

	prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);

	prog_stack = kcalloc(nr_preds, sizeof(*prog_stack), GFP_KERNEL);

	if (!prog_stack) {

		parse_error(pe, -ENOMEM, 0);

		goto out_free;
@@ -576,7 +576,11 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, 
out_free:

	kfree(op_stack);

	kfree(inverts);

	if (prog_stack) {

		for (i = 0; prog_stack[i].pred; i++)

			kfree(prog_stack[i].pred);

		kfree(prog_stack);

	}

	return ERR_PTR(ret);

}