diff options
| author | Steven Rostedt <[email protected]> | 2025-06-10 13:33:48 +0000 |
|---|---|---|
| committer | Steven Rostedt (Google) <[email protected]> | 2025-06-10 13:39:58 +0000 |
| commit | 8a157d8a00e815cab4432653cb50c9cedbbb4931 (patch) | |
| tree | e282d839bf33bf2a74184f2f035ca344dbd6f345 /lib/crypto/mpi/mpi-mul.c | |
| parent | Linux 6.16-rc1 (diff) | |
| download | kernel-8a157d8a00e815cab4432653cb50c9cedbbb4931.tar.gz kernel-8a157d8a00e815cab4432653cb50c9cedbbb4931.zip | |
tracing: Do not free "head" on error path of filter_free_subsystem_filters()
The variable "head" is allocated and initialized as a list before
allocating the first "item" for the list. If the allocation of "item"
fails, it frees "head" and then jumps to the label "free_now" which will
process head and free it.
This will cause a UAF of "head", and it doesn't need to free it before
jumping to the "free_now" label as that code will free it.
Cc: Masami Hiramatsu <[email protected]>
Cc: Mathieu Desnoyers <[email protected]>
Link: https://lore.kernel.org/[email protected]
Fixes: a9d0aab5eb33 ("tracing: Fix regression of filter waiting a long time on RCU synchronization")
Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Closes: https://lore.kernel.org/r/[email protected]/
Signed-off-by: Steven Rostedt (Google) <[email protected]>
Diffstat (limited to 'lib/crypto/mpi/mpi-mul.c')
0 files changed, 0 insertions, 0 deletions