Re: [PATCH 081/190] Revert "tracing: Fix a memory leak by early error exit in trace_pid_write()"

Steven Rostedt
2021-04-21T13:29:24Z

On Wed, 21 Apr 2021 14:59:16 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> This reverts commit 91862cc7867bba4ee5c8fcf0ca2f1d30427b6129.
>
> Commits from @umn.edu addresses have been found to be submitted in "bad
> faith" to try to test the kernel community's ability to review "known
> malicious" changes. The result of these submissions can be found in a
> paper published at the 42nd IEEE Symposium on Security and Privacy
> entitled, "Open Source Insecurity: Stealthily Introducing
> Vulnerabilities via Hypocrite Commits" written by Qiushi Wu (University
> of Minnesota) and Kangjie Lu (University of Minnesota).
>
> Because of this, all submissions from this group must be reverted from
> the kernel tree and will need to be re-reviewed again to determine if
> they actually are a valid fix. Until that work is complete, remove this
> change to ensure that no problems are being introduced into the
> codebase.
>

I have reviewed this change, and this is a valid fix and does not need to
be reverted.

The code before the change is:

if (trace_parser_get_init(&parser, PID_BUF_SIZE + 1))
return -ENOMEM;

Where that does:

int trace_parser_get_init(struct trace_parser *parser, int size)
{
memset(parser, 0, sizeof(*parser));

parser->buffer = kmalloc(size, GFP_KERNEL);
if (!parser->buffer)
return 1;

parser->size = size;
return 0;
}

And the trace_parser_put() does:

void trace_parser_put(struct trace_parser *parser)
{
kfree(parser->buffer);
parser->buffer = NULL;
}

Hence, exiting the function without calling trace_parser_put() will indeed
leak memory.

Please do not revert this patch.

Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>

-- Steve

> Cc: http
> Cc: stable@vger.kernel.org
> Cc: Wenwen Wang <wang6495@umn.edu>
> Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> kernel/trace/trace.c | 5 +----
> 1 file changed, 1 insertion(+), 4 deletions(-)
>
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 5c777627212f..faed4f44d224 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -691,10 +691,8 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
> * not modified.
> */
> pid_list = kmalloc(sizeof(*pid_list), GFP_KERNEL);
> - if (!pid_list) {
> - trace_parser_put(&parser);
> + if (!pid_list)
> return -ENOMEM;
> - }
>
> pid_list->pid_max = READ_ONCE(pid_max);
>
> @@ -704,7 +702,6 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
>
> pid_list->pids = vzalloc((pid_list->pid_max + 7) >> 3);
> if (!pid_list->pids) {
> - trace_parser_put(&parser);
> kfree(pid_list);
> return -ENOMEM;
> }