Commit 6921d1e0 authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Steven Rostedt (Google)
Browse files

tracing: Fix filter logic error 

If the processing of the tr->events loop fails, the filter that has been
added to filter_head will be released twice in free_filter_list(&head->rcu)
and __free_filter(filter).

After adding the filter of tr->events, add the filter to the filter_head
process to avoid triggering uaf.

Link: https://lore.kernel.org/tencent_4EF87A626D702F816CD0951CE956EC32CD0A@qq.com


Fixes: a9d0aab5 ("tracing: Fix regression of filter waiting a long time on RCU synchronization")
Reported-by: default avatar <syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=daba72c4af9915e9c894


Tested-by: default avatar <syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com>
Acked-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 86731a2a

kernel/trace/trace_events_filter.c

+7 −7
Original line number Diff line number Diff line
@@ -1436,13 +1436,6 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir, 


	INIT_LIST_HEAD(&head->list);



	item = kmalloc(sizeof(*item), GFP_KERNEL);

	if (!item)

		goto free_now;



	item->filter = filter;

	list_add_tail(&item->list, &head->list);



	list_for_each_entry(file, &tr->events, list) {

		if (file->system != dir)

			continue;
@@ -1454,6 +1447,13 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir, 
		event_clear_filter(file);

	}



	item = kmalloc(sizeof(*item), GFP_KERNEL);

	if (!item)

		goto free_now;



	item->filter = filter;

	list_add_tail(&item->list, &head->list);



	delay_free_filter(head);

	return;

 free_now: