linux-kernel - [for-linus][PATCH] tracing: Fix possible memory leak in __create_synth

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20211210094526.4483a105@gandalf.local.home>
Date:   Fri, 10 Dec 2021 09:45:26 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     LKML <linux-kernel@...r.kernel.org>
Cc:     Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Miaoqian Lin <linmq006@...il.com>,
        Tom Zanussi <zanussi@...nel.org>
Subject: [for-linus][PATCH] tracing: Fix possible memory leak in
 __create_synth_event() error path


Tracing update for 5.16:

- Fix memory leak in error path of __create_synth_event()

Miaoqian Lin (1):
      tracing: Fix possible memory leak in __create_synth_event() error path

----
 kernel/trace/trace_events_synth.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
---------------------------
commit c24be24aed405d64ebcf04526614c13b2adfb1d2
Author: Miaoqian Lin <linmq006@...il.com>
Date:   Thu Dec 9 02:43:17 2021 +0000

    tracing: Fix possible memory leak in __create_synth_event() error path
    
    There's error paths in __create_synth_event() after the argv is allocated
    that fail to free it. Add a jump to free it when necessary.
    
    Link: https://lkml.kernel.org/r/20211209024317.11783-1-linmq006@gmail.com
    
    Suggested-by: Steven Rostedt (VMware) <rostedt@...dmis.org>
    Signed-off-by: Miaoqian Lin <linmq006@...il.com>
    [ Fixed up the patch and change log ]
    Signed-off-by: Steven Rostedt (VMware) <rostedt@...dmis.org>

diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
index 22db3ce95e74..ca9c13b2ecf4 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -1237,9 +1237,8 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 						  argv + consumed, &consumed,
 						  &field_version);
 			if (IS_ERR(field)) {
-				argv_free(argv);
 				ret = PTR_ERR(field);
-				goto err;
+				goto err_free_arg;
 			}
 
 			/*
@@ -1262,18 +1261,19 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 			if (cmd_version > 1 && n_fields_this_loop >= 1) {
 				synth_err(SYNTH_ERR_INVALID_CMD, errpos(field_str));
 				ret = -EINVAL;
-				goto err;
+				goto err_free_arg;
 			}
 
 			fields[n_fields++] = field;
 			if (n_fields == SYNTH_FIELDS_MAX) {
 				synth_err(SYNTH_ERR_TOO_MANY_FIELDS, 0);
 				ret = -EINVAL;
-				goto err;
+				goto err_free_arg;
 			}
 
 			n_fields_this_loop++;
 		}
+		argv_free(argv);
 
 		if (consumed < argc) {
 			synth_err(SYNTH_ERR_INVALID_CMD, 0);
@@ -1281,7 +1281,6 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 			goto err;
 		}
 
-		argv_free(argv);
 	}
 
 	if (n_fields == 0) {
@@ -1307,6 +1306,8 @@ static int __create_synth_event(const char *name, const char *raw_fields)
 	kfree(saved_fields);
 
 	return ret;
+ err_free_arg:
+	argv_free(argv);
  err:
 	for (i = 0; i < n_fields; i++)
 		free_synth_field(fields[i]);