]>
Commit | Line | Data |
---|---|---|
4821c118 GKH |
1 | From e7f0c424d0806b05d6f47be9f202b037eb701707 Mon Sep 17 00:00:00 2001 |
2 | From: "zhangyi (F)" <yi.zhang@huawei.com> | |
3 | Date: Wed, 13 Feb 2019 20:29:06 +0800 | |
4 | Subject: tracing: Do not free iter->trace in fail path of tracing_open_pipe() | |
5 | ||
6 | From: zhangyi (F) <yi.zhang@huawei.com> | |
7 | ||
8 | commit e7f0c424d0806b05d6f47be9f202b037eb701707 upstream. | |
9 | ||
10 | Commit d716ff71dd12 ("tracing: Remove taking of trace_types_lock in | |
11 | pipe files") use the current tracer instead of the copy in | |
12 | tracing_open_pipe(), but it forget to remove the freeing sentence in | |
13 | the error path. | |
14 | ||
15 | There's an error path that can call kfree(iter->trace) after the iter->trace | |
16 | was assigned to tr->current_trace, which would be bad to free. | |
17 | ||
18 | Link: http://lkml.kernel.org/r/1550060946-45984-1-git-send-email-yi.zhang@huawei.com | |
19 | ||
20 | Cc: stable@vger.kernel.org | |
21 | Fixes: d716ff71dd12 ("tracing: Remove taking of trace_types_lock in pipe files") | |
22 | Signed-off-by: zhangyi (F) <yi.zhang@huawei.com> | |
23 | Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> | |
24 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
25 | ||
26 | --- | |
27 | kernel/trace/trace.c | 1 - | |
28 | 1 file changed, 1 deletion(-) | |
29 | ||
30 | --- a/kernel/trace/trace.c | |
31 | +++ b/kernel/trace/trace.c | |
32 | @@ -5626,7 +5626,6 @@ out: | |
33 | return ret; | |
34 | ||
35 | fail: | |
36 | - kfree(iter->trace); | |
37 | kfree(iter); | |
38 | __trace_array_put(tr); | |
39 | mutex_unlock(&trace_types_lock); |