queue-5.1/tracing-avoid-memory-leak-in-predicate_parse.patch

   1 From dfb4a6f2191a80c8b790117d0ff592fd712d3296 Mon Sep 17 00:00:00 2001
   2 From: Tomas Bortoli <tomasbortoli@gmail.com>
   3 Date: Tue, 28 May 2019 17:43:38 +0200
   4 Subject: tracing: Avoid memory leak in predicate_parse()
   5
   6 From: Tomas Bortoli <tomasbortoli@gmail.com>
   7
   8 commit dfb4a6f2191a80c8b790117d0ff592fd712d3296 upstream.
   9
  10 In case of errors, predicate_parse() goes to the out_free label
  11 to free memory and to return an error code.
  12
  13 However, predicate_parse() does not free the predicates of the
  14 temporary prog_stack array, thence leaking them.
  15
  16 Link: http://lkml.kernel.org/r/20190528154338.29976-1-tomasbortoli@gmail.com
  17
  18 Cc: stable@vger.kernel.org
  19 Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster")
  20 Reported-by: syzbot+6b8e0fb820e570c59e19@syzkaller.appspotmail.com
  21 Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
  22 [ Added protection around freeing prog_stack[i].pred ]
  23 Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25
  26 ---
  27  kernel/trace/trace_events_filter.c |    8 ++++++--
  28  1 file changed, 6 insertions(+), 2 deletions(-)
  29
  30 --- a/kernel/trace/trace_events_filter.c
  31 +++ b/kernel/trace/trace_events_filter.c
  32 @@ -427,7 +427,7 @@ predicate_parse(const char *str, int nr_
  33         op_stack = kmalloc_array(nr_parens, sizeof(*op_stack), GFP_KERNEL);
  34         if (!op_stack)
  35                 return ERR_PTR(-ENOMEM);
  36 -       prog_stack = kmalloc_array(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
  37 +       prog_stack = kcalloc(nr_preds, sizeof(*prog_stack), GFP_KERNEL);
  38         if (!prog_stack) {
  39                 parse_error(pe, -ENOMEM, 0);
  40                 goto out_free;
  41 @@ -578,7 +578,11 @@ predicate_parse(const char *str, int nr_
  42  out_free:
  43         kfree(op_stack);
  44         kfree(inverts);
  45 -       kfree(prog_stack);
  46 +       if (prog_stack) {
  47 +               for (i = 0; prog_stack[i].pred; i++)
  48 +                       kfree(prog_stack[i].pred);
  49 +               kfree(prog_stack);
  50 +       }
  51         return ERR_PTR(ret);
  52  }
  53