Keita Suzuki
c27f744cee
tracing: Fix potential double free in create_var_ref() ...
commit 99696a2592bca641eb88cc9a80c90e591afebd0f upstream.
In create_var_ref(), init_var_ref() is called to initialize the fields
of variable ref_field, which is allocated in the previous function call
to create_hist_field(). Function init_var_ref() allocates the
corresponding fields such as ref_field->system, but frees these fields
when the function encounters an error. The caller later calls
destroy_hist_field() to conduct error handling, which frees the fields
and the variable itself. This results in double free of the fields which
are already freed in the previous function.
Fix this by storing NULL to the corresponding fields when they are freed
in init_var_ref().
Link: https://lkml.kernel.org/r/20220425063739.3859998-1-keitasuzuki.park@sslab.ics.keio.ac.jp
Fixes: 067fe038e7stable@vger.kernel.org
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Tom Zanussi <zanussi@kernel.org>
Signed-off-by: Keita Suzuki <keitasuzuki.park@sslab.ics.keio.ac.jp>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-06-14 18:11:46 +02:00
bpf: Fix excessive memory allocation in stack_map_alloc()
2022-06-14 18:11:32 +02:00
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
2022-05-18 09:47:27 +02:00
lockdown: also lock down previous kgdb use
2022-06-06 08:33:48 +02:00
dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC
2022-06-14 18:11:28 +02:00
perf: Fix sys_perf_event_open() race against self
2022-05-25 09:14:34 +02:00
gcov: re-fix clang-11+ support
2021-04-14 08:24:10 +02:00
genirq: Synchronize interrupt thread startup
2022-05-12 12:23:41 +02:00
livepatch: Nullify obj->mod in klp_module_coming()'s error path
2019-08-19 13:03:37 +02:00
locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-17 09:48:28 +01:00
PM: suspend: fix return value of __setup handler
2022-04-15 14:18:05 +02:00
printk: fix return value of printk.devkmsg __setup handler
2022-04-15 14:18:08 +02:00
rcu: Don't deboost before reporting expedited quiescent state
2022-03-28 08:46:48 +02:00
sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq
2022-06-14 18:11:33 +02:00
tick/nohz: Use WARN_ON_ONCE() to prevent console saturation
2022-04-20 09:19:39 +02:00
tracing: Fix potential double free in create_var_ref()
2022-06-14 18:11:46 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
Revert "module, async: async_synchronize_full() on module init iff async is used"
2022-02-23 11:59:56 +01:00
audit: improve audit queue handling when "audit=1" on cmdline
2022-02-08 18:24:26 +01:00
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 13:17:32 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
kernel/configs: Replace GPL boilerplate code with SPDX identifier
2019-07-30 18:34:15 +02:00
cpu/hotplug: Cure the cpusets trainwreck
2021-07-19 08:53:15 +02:00
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-22 09:31:22 +02:00
keys: Fix request_key() cache
2020-01-17 19:48:42 +01:00
don't dump the threads that had been already exiting when zapped.
2020-11-18 19:20:31 +01:00
extable: Add function to search only kernel exception table
2019-08-21 22:23:48 +10:00
fail_function: Remove a redundant mutex unlock
2020-11-24 13:29:18 +01:00
copy_process(): Move fd_install() out of sighand->siglock critical section
2022-02-23 12:00:00 +01:00
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-06-30 08:47:55 -04:00
kbuild: add variables for compression tools
2020-09-03 11:27:10 +02:00
mm/nvdimm: add is_ioremap_addr and use that to check ioremap address
2019-07-12 11:05:40 -07:00
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y
2019-07-22 18:05:11 +02:00
kexec_load: Disable at runtime if the kernel is locked down
2019-08-19 21:54:15 -07:00
kernel: kexec: remove the lock operation of system_transition_mutex
2021-02-03 23:25:56 +01:00
kexec_elf: support 32 bit ELF files
2019-09-06 23:58:44 +02:00
kernel: kexec_file: fix error return code of kexec_calculate_store_digests()
2021-05-19 10:08:28 +02:00
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
kprobes: Limit max data_size of the kretprobe instances
2021-12-08 09:01:10 +01:00
kthread: Fix PF_KTHREAD vs to_kthread() race
2021-09-12 08:56:39 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
module/ftrace: handle patchable-function-entry
2022-02-23 11:59:56 +01:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
2020-10-01 13:17:23 +02:00
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
panic: ensure preemption is disabled during panic()
2019-10-07 15:47:19 -07:00
lockdown: Lock down module params that specify hardware parameters (eg. ioport)
2019-08-19 21:54:16 -07:00
kernel/pid.c: convert struct pid count to refcount_t
2019-07-16 19:23:24 -07:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 12:26:37 +02:00
profiling: fix shift-out-of-bounds bugs
2021-09-26 14:07:09 +02:00
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 18:11:24 +02:00
reboot: fix overflow parsing reboot cpu number
2020-11-18 19:20:30 +01:00
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:40:51 +02:00
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
seccomp: Invalidate seccomp mode to catch death failures
2022-02-16 12:52:53 +01:00
signal: Remove the bogus sigkill_pending in ptrace_stop
2021-11-17 09:48:24 +01:00
smp: Fix offline cpu check in flush_smp_call_function_queue()
2022-04-20 09:19:39 +02:00
kthread: Extract KTHREAD_IS_PER_CPU
2021-02-07 15:35:49 +01:00
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-07-08 11:01:13 -07:00
stacktrace: Don't skip first entry on noncurrent tasks
2019-11-04 21:19:25 +01:00
stop_machine: Avoid potential race behaviour
2019-10-17 12:47:12 +02:00
prctl: allow to setup brk for et_dyn executables
2021-09-26 14:07:08 +02:00
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
2022-03-11 11:22:37 +01:00
taskstats: fix data-race
2020-01-09 10:19:54 +01:00
torture: Remove exporting of internal functions
2019-08-01 14:30:22 -07:00
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:59:57 +01:00
proc/sysctl: add shared variables for range check
2019-07-18 17:08:07 -07:00
usermodehelper: reset umask to default before executing user process
2020-10-14 10:32:58 +02:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
Keyrings namespacing
2019-07-08 19:36:47 -07:00
Keyrings namespacing
2019-07-08 19:36:47 -07:00
watchdog/softlockup: Enforce that timestamp is valid on boot
2020-02-24 08:36:52 +01:00
workqueue: Fix unbind_workers() VS wq_worker_running() race
2022-01-16 09:15:38 +01:00
c27f744cee