Commit 9af40584 authored by Valentin Schneider's avatar Valentin Schneider Committed by Steven Rostedt (Google)
Browse files

tracing/filters: Fix error-handling of cpulist parsing buffer 

parse_pred() allocates a string buffer to parse the user-provided cpulist,
but doesn't check the allocation result nor does it free the buffer once it
is no longer needed.

Add an allocation check, and free the buffer as soon as it is no longer
needed.

Link: https://lkml.kernel.org/r/20230901151039.125186-2-vschneid@redhat.com



Cc: Masami Hiramatsu <mhiramat@kernel.org>
Reported-by: default avatarSteven Rostedt <rostedt@goodmis.org>
Reported-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: default avatarValentin Schneider <vschneid@redhat.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 3d07fa1d

kernel/trace/trace_events_filter.c

+8 −2
Original line number Diff line number Diff line
@@ -1744,17 +1744,23 @@ static int parse_pred(const char *str, void *data, 


		/* Copy the cpulist between { and } */

		tmp = kmalloc((i - maskstart) + 1, GFP_KERNEL);

		strscpy(tmp, str + maskstart, (i - maskstart) + 1);

		if (!tmp)

			goto err_mem;



		strscpy(tmp, str + maskstart, (i - maskstart) + 1);

		pred->mask = kzalloc(cpumask_size(), GFP_KERNEL);

		if (!pred->mask)

		if (!pred->mask) {

			kfree(tmp);

			goto err_mem;

		}



		/* Now parse it */

		if (cpulist_parse(tmp, pred->mask)) {

			kfree(tmp);

			parse_error(pe, FILT_ERR_INVALID_CPULIST, pos + i);

			goto err_free;

		}

		kfree(tmp);



		/* Move along */

		i++;