diff options
| author | Valentin Schneider <vschneid@redhat.com> | 2023-09-01 17:10:36 +0200 |
|---|---|---|
| committer | Steven Rostedt (Google) <rostedt@goodmis.org> | 2023-09-02 03:27:22 +0200 |
| commit | 9af4058493c59721eccd90b7c40cad793e4e3c3b (patch) | |
| tree | 57813982ac73f94a4250292cf42e1b225b844286 | |
| parent | tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY (diff) | |
| download | linux-9af4058493c59721eccd90b7c40cad793e4e3c3b.tar.xz linux-9af4058493c59721eccd90b7c40cad793e4e3c3b.zip | |
tracing/filters: Fix error-handling of cpulist parsing buffer
parse_pred() allocates a string buffer to parse the user-provided cpulist,
but doesn't check the allocation result nor does it free the buffer once it
is no longer needed.
Add an allocation check, and free the buffer as soon as it is no longer
needed.
Link: https://lkml.kernel.org/r/20230901151039.125186-2-vschneid@redhat.com
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Reported-by: Steven Rostedt <rostedt@goodmis.org>
Reported-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Valentin Schneider <vschneid@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
| -rw-r--r-- | kernel/trace/trace_events_filter.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 3a529214a21b..c06e1d596f4b 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -1744,17 +1744,23 @@ static int parse_pred(const char *str, void *data, /* Copy the cpulist between { and } */ tmp = kmalloc((i - maskstart) + 1, GFP_KERNEL); - strscpy(tmp, str + maskstart, (i - maskstart) + 1); + if (!tmp) + goto err_mem; + strscpy(tmp, str + maskstart, (i - maskstart) + 1); pred->mask = kzalloc(cpumask_size(), GFP_KERNEL); - if (!pred->mask) + if (!pred->mask) { + kfree(tmp); goto err_mem; + } /* Now parse it */ if (cpulist_parse(tmp, pred->mask)) { + kfree(tmp); parse_error(pe, FILT_ERR_INVALID_CPULIST, pos + i); goto err_free; } + kfree(tmp); /* Move along */ i++; |