lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 23 May 2012 11:36:49 +0900 From: Namhyung Kim <namhyung.kim@....com> To: Arnaldo Carvalho de Melo <acme@...stprotocols.net> Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>, Paul Mackerras <paulus@...ba.org>, Ingo Molnar <mingo@...hat.com>, Namhyung Kim <namhyung@...il.com>, LKML <linux-kernel@...r.kernel.org>, Steven Rostedt <rostedt@...dmis.org>, Frederic Weisbecker <fweisbec@...il.com>, Ingo Molnar <mingo@...nel.org>, Arnaldo Carvalho de Melo <acme@...radead.org>, Borislav Petkov <bp@...en8.de>, David Ahern <dsahern@...il.com> Subject: [PATCH 12/22] lib/traceevent: Fix a possibly wrong memory dereference If set_op_prio() failed, the token will be freed at out_free, then arg->op.op would turn out to be a dangle pointer. After returning EVENT_ERROR from process_op(), free_arg() will be called and then it will finally see the dangling pointer. Link: http://lkml.kernel.org/r/1333940074-19052-8-git-send-email-namhyung.kim@lge.com Signed-off-by: Namhyung Kim <namhyung.kim@....com> Cc: Frederic Weisbecker <fweisbec@...il.com> Cc: Ingo Molnar <mingo@...nel.org> Cc: Arnaldo Carvalho de Melo <acme@...radead.org> Cc: Borislav Petkov <bp@...en8.de> Cc: David Ahern <dsahern@...il.com> Signed-off-by: Steven Rostedt <rostedt@...dmis.org> --- tools/lib/traceevent/event-parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c index 6a8e3169ac68..865d0f268274 100644 --- a/tools/lib/traceevent/event-parse.c +++ b/tools/lib/traceevent/event-parse.c @@ -1747,6 +1747,8 @@ process_op(struct event_format *event, struct print_arg *arg, char **tok) if (set_op_prio(arg) == -1) { event->flags |= EVENT_FL_FAILED; + /* arg->op.op (= token) will be freed at out_free */ + arg->op.op = NULL; goto out_free; } -- 1.7.10.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists