Skip to content
Commit 6921d1e0 authored by Edward Adam Davis's avatar Edward Adam Davis Committed by Steven Rostedt (Google)
Browse files

tracing: Fix filter logic error

If the processing of the tr->events loop fails, the filter that has been
added to filter_head will be released twice in free_filter_list(&head->rcu)
and __free_filter(filter).

After adding the filter of tr->events, add the filter to the filter_head
process to avoid triggering uaf.

Link: https://lore.kernel.org/tencent_4EF87A626D702F816CD0951CE956EC32CD0A@qq.com


Fixes: a9d0aab5 ("tracing: Fix regression of filter waiting a long time on RCU synchronization")
Reported-by: default avatar <syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=daba72c4af9915e9c894


Tested-by: default avatar <syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com>
Acked-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: default avatarEdward Adam Davis <eadavis@qq.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 86731a2a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment