Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d496aab5 authored by Ananth N Mavinakayanahalli's avatar Ananth N Mavinakayanahalli Committed by Linus Torvalds
Browse files

kprobes: initialize before using a hlist 



Commit ef53d9c5 ("kprobes: improve kretprobe scalability with hashed
locking") introduced a bug where we can potentially leak
kretprobe_instances since we initialize a hlist head after having used
it.

Initialize the hlist head before using it.

Reported by: Jim Keniston <jkenisto@us.ibm.com>
Acked-by: default avatarJim Keniston <jkenisto@us.ibm.com>
Signed-off-by: default avatarAnanth N Mavinakayanahalli <ananth@in.ibm.com>
Acked-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Srinivasa D S <srinivasa@in.ibm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 2a4e64b8

kernel/kprobes.c

+1 −1
Original line number Original line Diff line number Diff line
@@ -1077,6 +1077,7 @@ void __kprobes kprobe_flush_task(struct task_struct *tk) 
		/* Early boot.  kretprobe_table_locks not yet initialized. */

		/* Early boot.  kretprobe_table_locks not yet initialized. */

		return;

		return;





	INIT_HLIST_HEAD(&empty_rp);

	hash = hash_ptr(tk, KPROBE_HASH_BITS);

	hash = hash_ptr(tk, KPROBE_HASH_BITS);

	head = &kretprobe_inst_table[hash];

	head = &kretprobe_inst_table[hash];

	kretprobe_table_lock(hash, &flags);

	kretprobe_table_lock(hash, &flags);
@@ -1085,7 +1086,6 @@ void __kprobes kprobe_flush_task(struct task_struct *tk) 
			recycle_rp_inst(ri, &empty_rp);

			recycle_rp_inst(ri, &empty_rp);

	}

	}

	kretprobe_table_unlock(hash, &flags);

	kretprobe_table_unlock(hash, &flags);

	INIT_HLIST_HEAD(&empty_rp);

	hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {

	hlist_for_each_entry_safe(ri, node, tmp, &empty_rp, hlist) {

		hlist_del(&ri->hlist);

		hlist_del(&ri->hlist);

		kfree(ri);

		kfree(ri);