linux/kernel/trace
Kalesh Singh f86b0aaad7 tracing/histogram: Fix UAF in destroy_hist_field()
Calling destroy_hist_field() on an expression will recursively free
any operands associated with the expression. If during expression
parsing the operands of the expression are already set when an error
is encountered, there is no need to explicity free the operands. Doing
so will result in destroy_hist_field() being called twice for the
operands and lead to a use-after-free (UAF) error.

If the operands are associated with the expression, only call
destroy_hist_field() on the expression since the operands will be
recursively freed.

Link: https://lore.kernel.org/all/CAHk-=wgcrEbFgkw9720H3tW-AhHOoEKhYwZinYJw4FpzSaJ6_Q@mail.gmail.com/
Link: https://lkml.kernel.org/r/20211118011542.1420131-1-kaleshsingh@google.com

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Fixes: 8b5d46fd7a ("tracing/histogram: Optimize division by constants")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
2021-11-18 13:53:43 -05:00
..
blktrace.c block: don't call blk_status_to_errno in blk_update_request 2021-10-19 05:54:57 -06:00
bpf_trace.c bpf: Factor out helpers for ctx access checking 2021-11-01 14:10:00 -07:00
bpf_trace.h bpf: Use dedicated bpf_trace_printk event instead of trace_printk() 2020-07-13 16:55:49 -07:00
error_report-traces.c tracing: add error_report_end trace point 2021-02-26 09:41:02 -08:00
fgraph.c x86/ftrace: Make function graph use ftrace directly 2021-10-20 23:44:43 -04:00
ftrace_internal.h x86/ftrace: Have ftrace trampolines turn read-only at the end of system boot up 2020-05-12 18:24:34 -04:00
ftrace.c Two tracing fixes: 2021-11-11 10:16:33 -08:00
Kconfig tracing: Simplify the Kconfig dependency of FTRACE 2021-08-16 11:37:20 -04:00
kprobe_event_gen_test.c tracing: Add kprobe event command generation test module 2020-01-30 09:46:28 -05:00
Makefile tracing: Place trace_pid_list logic into abstract functions 2021-10-05 17:30:08 -04:00
pid_list.c tracing: Initialize upper and lower vars in pid_list_refill_irq() 2021-10-07 09:56:38 -04:00
pid_list.h tracing: Create a sparse bitmask for pid filtering 2021-10-05 17:38:45 -04:00
power-traces.c
preemptirq_delay_test.c kernel: trace: preemptirq_delay_test: add cpu affinity 2021-02-02 17:02:07 -05:00
ring_buffer_benchmark.c sched,tracing: Convert to sched_set_fifo() 2020-07-29 11:43:53 +02:00
ring_buffer.c ring-buffer: Protect ring_buffer_reset() from reentrancy 2021-11-10 11:56:29 -05:00
rpm-traces.c
synth_event_gen_test.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_benchmark.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_benchmark.h
trace_boot.c tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks 2021-10-26 09:18:10 -04:00
trace_branch.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_clock.c tracing: Do no increment trace_clock_global() by one 2021-06-18 09:10:00 -04:00
trace_dynevent.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_dynevent.h tracing: Add DYNAMIC flag for dynamic events 2021-08-18 18:10:32 -04:00
trace_entries.h trace: Add timerlat tracer 2021-06-25 19:57:24 -04:00
trace_eprobe.c tracing: Fix misspelling of "missing" 2021-10-29 09:54:14 -04:00
trace_event_perf.c tracing: Show size of requested perf buffer 2021-10-27 12:25:09 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing: Update create_system_filter() kernel-doc comment 2021-03-25 16:04:35 -04:00
trace_events_hist.c tracing/histogram: Fix UAF in destroy_hist_field() 2021-11-18 13:53:43 -05:00
trace_events_inject.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_events_synth.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_events_trigger.c tracing: Add a probe that attaches to trace events 2021-08-20 14:18:40 -04:00
trace_events.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_export.c tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00
trace_functions_graph.c tracing: in_irq() cleanup 2021-10-13 18:19:41 -04:00
trace_functions.c ftrace: disable preemption when recursion locked 2021-10-27 11:21:49 -04:00
trace_hwlat.c tracing/hwlat: Make some internal symbols static 2021-10-26 09:18:28 -04:00
trace_irqsoff.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_kdb.c kdb: Rename members of struct kdbtab_t 2021-07-27 17:05:06 +01:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_mmiotrace.c tracing: Remove definition of DEBUG in trace_mmiotrace.c 2021-02-02 17:02:07 -05:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Make osnoise_instances static 2021-11-12 09:25:59 -05:00
trace_output.c tracing: Show kretprobe unknown indicator only for kretprobe_trampoline 2021-09-30 21:24:08 -04:00
trace_output.h ftrace: Add recording of functions that caused recursion 2020-11-06 08:42:26 -05:00
trace_preemptirq.c lockdep: fix order in trace_hardirqs_off_caller() 2020-09-14 10:08:07 +02:00
trace_printk.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_probe_tmpl.h tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs 2021-08-19 09:09:03 -04:00
trace_probe.c tracing: Add a probe that attaches to trace events 2021-08-20 14:18:40 -04:00
trace_probe.h tracing: Add a probe that attaches to trace events 2021-08-20 14:18:40 -04:00
trace_recursion_record.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_sched_switch.c tracing: Fix sched switch start/stop refcount racy updates 2020-01-30 09:46:10 -05:00
trace_sched_wakeup.c tracing: Change variable type as bool for clean-up 2021-06-30 09:19:14 -04:00
trace_selftest_dynamic.c
trace_selftest.c tracing: Fix selftest config check for function graph start up test 2021-10-21 14:18:48 -04:00
trace_seq.c tracing: Fix various typos in comments 2021-03-23 14:08:18 -04:00
trace_stack.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_stat.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace_stat.h tracing: Use generic type for comparator function 2019-11-14 13:15:11 -05:00
trace_synth.h tracing: synth events: increase max fields count 2021-09-08 15:29:16 -04:00
trace_syscalls.c tracing: Merge irqflags + preempt counter. 2021-02-02 17:02:06 -05:00
trace_uprobe.c tracing: Disable "other" permission bits in the tracefs files 2021-10-08 18:08:43 -04:00
trace.c Second set of tracing updates for 5.16: 2021-11-03 09:08:47 -07:00
trace.h tracing: in_irq() cleanup 2021-10-13 18:19:41 -04:00
tracing_map.c tracing/cfi: Fix cmp_entries_* functions signature mismatch 2021-10-19 20:33:20 -04:00
tracing_map.h tracing: Fix some typos in comments 2020-11-10 20:39:40 -05:00