From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Jing Xia <jing.xia@spreadtrum.com>,
Chunyan Zhang <chunyan.zhang@spreadtrum.com>,
"Steven Rostedt (VMware)" <rostedt@goodmis.org>
Subject: [PATCH 3.18 14/32] tracing: Fix crash when it fails to alloc ring buffer
Date: Mon, 1 Jan 2018 15:22:21 +0100 [thread overview]
Message-ID: <20180101140015.711730454@linuxfoundation.org> (raw)
In-Reply-To: <20180101140012.582300879@linuxfoundation.org>
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Xia <jing.xia@spreadtrum.com>
commit 24f2aaf952ee0b59f31c3a18b8b36c9e3d3c2cf5 upstream.
Double free of the ring buffer happens when it fails to alloc new
ring buffer instance for max_buffer if TRACER_MAX_TRACE is configured.
The root cause is that the pointer is not set to NULL after the buffer
is freed in allocate_trace_buffers(), and the freeing of the ring
buffer is invoked again later if the pointer is not equal to Null,
as:
instance_mkdir()
|-allocate_trace_buffers()
|-allocate_trace_buffer(tr, &tr->trace_buffer...)
|-allocate_trace_buffer(tr, &tr->max_buffer...)
// allocate fail(-ENOMEM),first free
// and the buffer pointer is not set to null
|-ring_buffer_free(tr->trace_buffer.buffer)
// out_free_tr
|-free_trace_buffers()
|-free_trace_buffer(&tr->trace_buffer);
//if trace_buffer is not null, free again
|-ring_buffer_free(buf->buffer)
|-rb_free_cpu_buffer(buffer->buffers[cpu])
// ring_buffer_per_cpu is null, and
// crash in ring_buffer_per_cpu->pages
Link: http://lkml.kernel.org/r/20171226071253.8968-1-chunyan.zhang@spreadtrum.com
Fixes: 737223fbca3b1 ("tracing: Consolidate buffer allocation code")
Signed-off-by: Jing Xia <jing.xia@spreadtrum.com>
Signed-off-by: Chunyan Zhang <chunyan.zhang@spreadtrum.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6268,7 +6268,9 @@ static int allocate_trace_buffers(struct
allocate_snapshot ? size : 1);
if (WARN_ON(ret)) {
ring_buffer_free(tr->trace_buffer.buffer);
+ tr->trace_buffer.buffer = NULL;
free_percpu(tr->trace_buffer.data);
+ tr->trace_buffer.data = NULL;
return -ENOMEM;
}
tr->allocated_snapshot = allocate_snapshot;
next prev parent reply other threads:[~2018-01-01 14:23 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-01 14:22 [PATCH 3.18 00/32] 3.18.91-stable review Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 01/32] ACPI: APEI / ERST: Fix missing error handling in erst_reader() Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 02/32] crypto: mcryptd - protect the per-CPU queue with a lock Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 03/32] mfd: twl4030-audio: Fix sibling-node lookup Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 04/32] mfd: twl6040: Fix child-node lookup Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 05/32] ALSA: rawmidi: Avoid racy info ioctl via ctl device Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 06/32] ALSA: usb-audio: Fix the missing ctl name suffix at parsing SU Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 07/32] PCI / PM: Force devices to D0 in pci_pm_thaw_noirq() Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 08/32] parisc: Hide Diva-built-in serial aux and graphics card Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 09/32] KVM: X86: Fix load RFLAGS w/o the fixed bit Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 10/32] powerpc/perf: Dereference BHRB entries safely Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 11/32] net: mvneta: clear interface link status on port disable Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 12/32] tracing: Remove extra zeroing out of the ring buffer page Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 13/32] tracing: Fix possible double free on failure of allocating trace buffer Greg Kroah-Hartman
2018-01-01 14:22 ` Greg Kroah-Hartman [this message]
2018-01-01 14:22 ` [PATCH 3.18 15/32] ring-buffer: Mask out the info bits when returning buffer page length Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 16/32] ASoC: twl4030: fix child-node lookup Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 17/32] kbuild: add -fno-stack-check to kernel build options Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 18/32] ipv4: igmp: guard against silly MTU values Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 19/32] ipv6: mcast: better catch silly mtu values Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 20/32] net: igmp: Use correct source address on IGMPv3 reports Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 21/32] netlink: Add netns check on taps Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 22/32] net: qmi_wwan: add Sierra EM7565 1199:9091 Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 23/32] tcp md5sig: Use skbs saddr when replying to an incoming segment Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 24/32] tg3: Fix rx hang on MTU change with 5717/5719 Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 25/32] net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 26/32] sctp: Replace use of sockets_allocated with specified macro Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 27/32] net: ipv4: fix for a race condition in raw_sendmsg Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 28/32] USB: serial: option: add support for Telit ME910 PID 0x1101 Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 29/32] usb: Add device quirk for Logitech HD Pro Webcam C925e Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 30/32] usb: add RESET_RESUME for ELSA MicroLink 56K Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 31/32] usb: xhci: Add XHCI_TRUST_TX_LENGTH for Renesas uPD720201 Greg Kroah-Hartman
2018-01-01 14:22 ` [PATCH 3.18 32/32] n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD) Greg Kroah-Hartman
2018-01-01 18:07 ` [PATCH 3.18 00/32] 3.18.91-stable review kernelci.org bot
2018-01-02 16:46 ` Guenter Roeck
2018-01-02 22:22 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180101140015.711730454@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=chunyan.zhang@spreadtrum.com \
--cc=jing.xia@spreadtrum.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).