Messages in this thread Patch in this message | | | Date | Sat, 18 Mar 2023 14:35:33 -0400 | From | Steven Rostedt <> | Subject | Re: [PATCH] tracing: Fix use-after-free and double-free on last_cmd |
| |
On Fri, 17 Mar 2023 13:30:44 +0800 Cheng-Jui Wang <cheng-jui.wang@mediatek.com> wrote:
> From: "Tze-nan Wu" <Tze-nan.Wu@mediatek.com>
Hi!
Thanks for the report and the patch. Some nits below.
Also change the subject to:
tracing/synthetic: Fix races on freeing last_cmd
> --- > kernel/trace/trace_events_synth.c | 23 +++++++++++++++++++---- > 1 file changed, 19 insertions(+), 4 deletions(-) > > diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c > index 46d0abb32d0f..ce438eccab2e 100644 > --- a/kernel/trace/trace_events_synth.c > +++ b/kernel/trace/trace_events_synth.c > @@ -42,16 +42,25 @@ enum { ERRORS }; > #undef C > #define C(a, b) b > > +static DEFINE_MUTEX(lastcmd_mutex); > + > static const char *err_text[] = { ERRORS }; > > static char *last_cmd;
Please keep the mutex and the variable it protects next to each other:
static DEFINE_MUTEX(lastcmd_mutex); static char *last_cmd;
> > static int errpos(const char *str) > { > - if (!str || !last_cmd) > - return 0; > + int ret = 0; > + > + mutex_lock(&lastcmd_mutex); > + if (!str || !last_cmd) {
Change this to just:
if (!str || !last_cmd) goto out;
> + mutex_unlock(&lastcmd_mutex); > + return ret;
> + } > > - return err_pos(last_cmd, str); > + ret = err_pos(last_cmd, str);
Add:
out:
> + mutex_unlock(&lastcmd_mutex); > + return ret; > } > > static void last_cmd_set(const char *str) > @@ -59,18 +68,24 @@ static void last_cmd_set(const char *str) > if (!str) > return; > > + mutex_lock(&lastcmd_mutex); > kfree(last_cmd); >
In this case, you can remove the space:
mutex_lock(&lastcmd_mutex); kfree(last_cmd); last_cmd = kstrdup(str, GFP_KERNEL); mutex_unlock(&lastcmd_mutex);
> last_cmd = kstrdup(str, GFP_KERNEL); > + mutex_unlock(&lastcmd_mutex); > } > > static void synth_err(u8 err_type, u16 err_pos) > { > - if (!last_cmd) > + mutex_lock(&lastcmd_mutex); > + if (!last_cmd) {
This should be:
if (!last_cmd) goto out;
> + mutex_unlock(&lastcmd_mutex); > return; > + } > > tracing_log_err(NULL, "synthetic_events", last_cmd, err_text, > err_type, err_pos);
out:
> + mutex_unlock(&lastcmd_mutex); > } > > static int create_synth_event(const char *raw_command);
Thanks,
-- Steve
| |