Pull tracing fix from Steven Rostedt: - Do not free "head" variable in filter_free_subsystem_filters() The first error path jumps to "free_now" label but first frees the newly allocated "head" variable. But the "free_now" code checks this variable, and if it is not NULL, it will iterate the list. As this list variable was already initialized, the "free_now" code will not do anything as it is empty. But freeing it will cause a UAF bug. The error path should simply jump to the "free_now" label and leave the "head" variable alone. * tag 'trace-v6.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Do not free "head" on error path of filter_free_subsystem_filters()
Unified · Split
| @@ -1437,10 +1437,8 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir, · 1436 unmodified lines | ||
| 1437 | 1437 | INIT_LIST_HEAD(&head->list); |
| 1438 | 1438 | |
| 1439 | 1439 | item = kmalloc(sizeof(*item), GFP_KERNEL); |
| 1440 | − if (!item) { | |
| 1441 | − kfree(head); | |
| 1440 | + if (!item) | |
| 1442 | 1441 | goto free_now; |
| 1443 | − } | |
| 1444 | 1442 | |
| 1445 | 1443 | item->filter = filter; |
| 1446 | 1444 | list_add_tail(&item->list, &head->list); |