linux-kernel - Re: [PATCH 1/2] tracing: Check total refcount before releasing bufs in profile

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20091008214258.GH5073@nowhere>
Date:	Thu, 8 Oct 2009 23:43:00 +0200
From:	Frederic Weisbecker <fweisbec@...il.com>
To:	Paul Mackerras <paulus@...ba.org>
Cc:	Ingo Molnar <mingo@...e.hu>, LKML <linux-kernel@...r.kernel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Li Zefan <lizf@...fujitsu.com>
Subject: Re: [PATCH 1/2] tracing: Check total refcount before releasing
	bufs in profile_enable failure

On Wed, Oct 07, 2009 at 02:08:27PM +1100, Paul Mackerras wrote:
> Frederic Weisbecker writes:
> 
> > When we call the profile_enable() callback of an event, we release the
> > shared perf event tracing buffers unconditionnaly in the failure path.
> > This is wrong because there may be other users of these. Then check the
> > total refcount before doing this.
> 
> [snip]
> 
> > -	kfree(trace_profile_buf_nmi);
> >  fail_buf_nmi:
> > -	kfree(trace_profile_buf);
> > +	if (!total_profile_count) {
> 
> A small problem here: total_profile_count will be 1, not 0, in the
> case where we need to free...
> 
> > +		kfree(trace_profile_buf_nmi);
> > +		kfree(trace_profile_buf);
> > +		trace_profile_buf_nmi = NULL;
> > +		trace_profile_buf = NULL;
> > +	}
> >  fail_buf:
> > -	total_profile_count--;
> 
> since we don't decrement total_profile_count until here.
> 
> Paul.


No, because now we only increment total_profile_count if
nothing has failed. This is even the last thing done
in the succeeded path. So if we fail and need to free, it
means its values is still 0.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/