linux-kernel - [GIT PULL] probes: Fixes for v6.9-rc6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240504221917.4917a9eac7ab8cc90a0af5a1@kernel.org>
Date: Sat, 4 May 2024 22:19:17 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: LuMingYin <lumingyindetect@....com>, Steven Rostedt
 <rostedt@...dmis.org>, Masami Hiramatsu <mhiramat@...nel.org>,
 linux-kernel@...r.kernel.org
Subject: [GIT PULL] probes: Fixes for v6.9-rc6

Hi Linus,

Probes fixes for v6.9-rc6:

- probe-events: Fix memory leak in parsing probe argument. There is a
  memory leak (forget to free an allocated buffer) in a memory allocation
  failure path. Fixes it to jump to the correct error handling code.


Please pull the latest probes-fixes-v6.9-rc6 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
probes-fixes-v6.9-rc6

Tag SHA1: 7ecfa9b34f812e244746158de5abfdd5132a4a62
Head SHA1: dce3696271af7765f04428ec31b1b87dc7d016c6


LuMingYin (1):
      tracing/probes: Fix memory leak in traceprobe_parse_probe_arg_body()

----
 kernel/trace/trace_probe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---------------------------
commit dce3696271af7765f04428ec31b1b87dc7d016c6
Author: LuMingYin <lumingyindetect@....com>
Date:   Sat Apr 27 08:23:47 2024 +0100

    tracing/probes: Fix memory leak in traceprobe_parse_probe_arg_body()
    
    If traceprobe_parse_probe_arg_body() failed to allocate 'parg->fmt',
    it jumps to the label 'out' instead of 'fail' by mistake.In the result,
    the buffer 'tmp' is not freed in this case and leaks its memory.
    
    Thus jump to the label 'fail' in that error case.
    
    Link: https://lore.kernel.org/all/20240427072347.1421053-1-lumingyindetect@126.com/
    
    Fixes: 032330abd08b ("tracing/probes: Cleanup probe argument parser")
    Signed-off-by: LuMingYin <lumingyindetect@....com>
    Acked-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>

diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
index dfe3ee6035ec..42bc0f362226 100644
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -1466,7 +1466,7 @@ static int traceprobe_parse_probe_arg_body(const char *argv, ssize_t *size,
 		parg->fmt = kmalloc(len, GFP_KERNEL);
 		if (!parg->fmt) {
 			ret = -ENOMEM;
-			goto out;
+			goto fail;
 		}
 		snprintf(parg->fmt, len, "%s[%d]", parg->type->fmttype,
 			 parg->count);

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>