On Tue, May 17, 2022 at 05:57:23PM +0800, Yuanjun Gong wrote:
From: Gong Yuanjun ruc_gongyuanjun@163.com
In hist_trigger_elt_data_alloc(), elt_data is freed by hist_elt_data_free() if kcalloc fails.
static int hist_trigger_elt_data_alloc(struct tracing_map_elt *elt) { ... elt_data->field_var_str = kcalloc(n_str, sizeof(char *), GFP_KERNEL); if (!elt_data->field_var_str) { hist_elt_data_free(elt_data); return -EINVAL; } ...}
In hist_elt_data_free() the elt_data->field_var_str field should be checked before dereference.
Signed-off-by: Gong Yuanjun ruc_gongyuanjun@163.com
kernel/trace/trace_events_hist.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 44db5ba9cabb..73177c9f94b2 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1576,11 +1576,11 @@ static void hist_elt_data_free(struct hist_elt_data *elt_data) { unsigned int i;
- for (i = 0; i < elt_data->n_field_var_str; i++)
kfree(elt_data->field_var_str[i]);- kfree(elt_data->field_var_str);
- if (elt_data->field_var_str) {
for (i = 0; i < elt_data->n_field_var_str; i++)kfree(elt_data->field_var_str[i]);kfree(elt_data->field_var_str);- } kfree(elt_data->comm); kfree(elt_data);
}
2.17.1
<formletter>
This is not the correct way to submit patches for inclusion in the stable kernel tree. Please read: https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html for how to do this properly.
</formletter>