From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-bn3nam01on0105.outbound.protection.outlook.com ([104.47.33.105]:23296 "EHLO NAM01-BN3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032102AbeCAP0T (ORCPT ); Thu, 1 Mar 2018 10:26:19 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: "Steven Rostedt (VMware)" , Sasha Levin Subject: [added to the 4.1 stable tree] tracing: Fix possible double free on failure of allocating trace buffer Date: Thu, 1 Mar 2018 15:23:10 +0000 Message-ID: <20180301152116.1486-71-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: "Steven Rostedt (VMware)" This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 4397f04575c44e1440ec2e49b6302785c95fd2f8 ] Jing Xia and Chunyan Zhang reported that on failing to allocate part of the tracing buffer, memory is freed, but the pointers that point to them are no= t initialized back to NULL, and later paths may try to free the freed memory again. Jing and Chunyan fixed one of the locations that does this, but missed a spot. Link: http://lkml.kernel.org/r/20171226071253.8968-1-chunyan.zhang@spreadtr= um.com Cc: stable@vger.kernel.org Fixes: 737223fbca3b1 ("tracing: Consolidate buffer allocation code") Reported-by: Jing Xia Reported-by: Chunyan Zhang Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Sasha Levin --- kernel/trace/trace.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 915fffdc5329..8437927928bc 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -6440,6 +6440,7 @@ allocate_trace_buffer(struct trace_array *tr, struct = trace_buffer *buf, int size buf->data =3D alloc_percpu(struct trace_array_cpu); if (!buf->data) { ring_buffer_free(buf->buffer); + buf->buffer =3D NULL; return -ENOMEM; } =20 --=20 2.14.1