[PATCH] tracing: Fix use-after-free and double-free on last_cmd
Steven Rostedt
rostedt at goodmis.org
Sat Mar 18 11:35:33 PDT 2023
On Fri, 17 Mar 2023 13:30:44 +0800
Cheng-Jui Wang <cheng-jui.wang at mediatek.com> wrote:
> From: "Tze-nan Wu" <Tze-nan.Wu at mediatek.com>
Hi!
Thanks for the report and the patch. Some nits below.
Also change the subject to:
tracing/synthetic: Fix races on freeing last_cmd
> ---
> kernel/trace/trace_events_synth.c | 23 +++++++++++++++++++----
> 1 file changed, 19 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c
> index 46d0abb32d0f..ce438eccab2e 100644
> --- a/kernel/trace/trace_events_synth.c
> +++ b/kernel/trace/trace_events_synth.c
> @@ -42,16 +42,25 @@ enum { ERRORS };
> #undef C
> #define C(a, b) b
>
> +static DEFINE_MUTEX(lastcmd_mutex);
> +
> static const char *err_text[] = { ERRORS };
>
> static char *last_cmd;
Please keep the mutex and the variable it protects next to each other:
static DEFINE_MUTEX(lastcmd_mutex);
static char *last_cmd;
>
> static int errpos(const char *str)
> {
> - if (!str || !last_cmd)
> - return 0;
> + int ret = 0;
> +
> + mutex_lock(&lastcmd_mutex);
> + if (!str || !last_cmd) {
Change this to just:
if (!str || !last_cmd)
goto out;
> + mutex_unlock(&lastcmd_mutex);
> + return ret;
> + }
>
> - return err_pos(last_cmd, str);
> + ret = err_pos(last_cmd, str);
Add:
out:
> + mutex_unlock(&lastcmd_mutex);
> + return ret;
> }
>
> static void last_cmd_set(const char *str)
> @@ -59,18 +68,24 @@ static void last_cmd_set(const char *str)
> if (!str)
> return;
>
> + mutex_lock(&lastcmd_mutex);
> kfree(last_cmd);
>
In this case, you can remove the space:
mutex_lock(&lastcmd_mutex);
kfree(last_cmd);
last_cmd = kstrdup(str, GFP_KERNEL);
mutex_unlock(&lastcmd_mutex);
> last_cmd = kstrdup(str, GFP_KERNEL);
> + mutex_unlock(&lastcmd_mutex);
> }
>
> static void synth_err(u8 err_type, u16 err_pos)
> {
> - if (!last_cmd)
> + mutex_lock(&lastcmd_mutex);
> + if (!last_cmd) {
This should be:
if (!last_cmd)
goto out;
> + mutex_unlock(&lastcmd_mutex);
> return;
> + }
>
> tracing_log_err(NULL, "synthetic_events", last_cmd, err_text,
> err_type, err_pos);
out:
> + mutex_unlock(&lastcmd_mutex);
> }
>
> static int create_synth_event(const char *raw_command);
Thanks,
-- Steve
More information about the Linux-mediatek
mailing list