Steven Rostedt 8a157d8a00 tracing: Do not free "head" on error path of filter_free_subsystem_filters() ... The variable "head" is allocated and initialized as a list before allocating the first "item" for the list. If the allocation of "item" fails, it frees "head" and then jumps to the label "free_now" which will process head and free it. This will cause a UAF of "head", and it doesn't need to free it before jumping to the "free_now" label as that code will free it. Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Link: https://lore.kernel.org/20250610093348.33c5643a@gandalf.local.home Fixes: a9d0aab5eb ("tracing: Fix regression of filter waiting a long time on RCU synchronization") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202506070424.lCiNreTI-lkp@intel.com/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>		2025-06-10 09:39:58 -04:00
..
rv	rv: Fix out-of-bound memory access in rv_is_container_monitor()	2025-04-12 12:13:30 -04:00
blktrace.c	traceevent/block: Add REQ_ATOMIC flag to block trace events	2025-05-23 09:18:48 -06:00
bpf_trace.c	bpf: Fix error return value in bpf_copy_from_user_dynptr	2025-05-23 13:25:02 -07:00
bpf_trace.h
error_report-traces.c
fgraph.c	ftrace: Show subops in enabled_functions	2025-05-08 09:36:08 -04:00
fprobe.c	tracing: fprobe: Fix RCU warning message in list traversal	2025-05-10 08:28:02 +09:00
ftrace.c	RISC-V Patches for the 6.16 Merge Window, Part 1	2025-06-06 18:05:18 -07:00
ftrace_internal.h
Kconfig	ftrace: Have tracing function args depend on PROBE_EVENTS_BTF_ARGS	2025-04-02 09:50:56 -04:00
kprobe_event_gen_test.c
Makefile
pid_list.c	tracing: Cleanup upper_empty() in pid_list	2025-05-14 11:19:32 -04:00
pid_list.h
power-traces.c
preemptirq_delay_test.c
rethook.c
ring_buffer.c	ring-buffer: Fix buffer locking in ring_buffer_subbuf_order_set()	2025-06-06 20:25:55 -04:00
ring_buffer_benchmark.c	ring-buffer: Use str_low_high() helper in ring_buffer_producer()	2024-10-19 11:12:25 -04:00
rpm-traces.c
synth_event_gen_test.c
trace.c	ring-buffer changes for v6.16:	2025-05-30 21:20:11 -07:00
trace.h	tracing: Allow the top level trace_marker to write into another instances	2025-05-09 15:19:11 -04:00
trace_benchmark.c
trace_benchmark.h
trace_boot.c
trace_branch.c	tracing: branch: Use trace_tracing_is_on_cpu() instead of "disabled" field	2025-05-09 15:19:10 -04:00
trace_btf.c
trace_btf.h
trace_clock.c	tracing: Use atomic64_inc_return() in trace_clock_counter()	2024-10-09 19:59:49 -04:00
trace_dynevent.c	tracing: probes: Fix a possible race in trace_probe_log APIs	2025-05-13 22:23:34 +09:00
trace_dynevent.h	tracing: probes: Fix a possible race in trace_probe_log APIs	2025-05-13 22:23:34 +09:00
trace_entries.h	ftrace: Expose call graph depth as unsigned int	2025-05-08 09:36:08 -04:00
trace_eprobe.c	tracing: add missing trace_probe_log_clear for eprobes	2025-05-10 08:44:50 +09:00
trace_event_perf.c	perf: Remove unnecessary parameter of security check	2025-02-26 14:13:58 -05:00
trace_events.c	tracing: Add a helper function to handle the dereference arg in verifier	2025-05-09 15:19:11 -04:00
trace_events_filter.c	tracing: Do not free "head" on error path of filter_free_subsystem_filters()	2025-06-10 09:39:58 -04:00
trace_events_filter_test.h
trace_events_hist.c	tracing: Rename event_trigger_alloc() to trigger_data_alloc()	2025-05-09 15:19:11 -04:00
trace_events_inject.c
trace_events_synth.c	tracing: Do not add length to print format in synthetic events	2025-04-09 11:34:21 -04:00
trace_events_trigger.c	tracing updates for v6.16:	2025-05-29 21:04:36 -07:00
trace_events_user.c	tracing/user_events: Slightly simplify user_seq_show()	2025-03-06 13:35:27 -05:00
trace_export.c
trace_fprobe.c	Probes fixes for v6.14:	2025-04-08 12:51:34 -07:00
trace_functions.c	tracing updates for v6.16:	2025-05-29 21:04:36 -07:00
trace_functions_graph.c	ftrace: Do not disabled function graph based on "disabled" field	2025-05-09 15:19:10 -04:00
trace_hwlat.c	tracing: Remove TRACE_EVENT_FL_FILTERED logic	2024-10-08 15:24:49 -04:00
trace_irqsoff.c	tracing: Use atomic_inc_return() for updating "disabled" counter in irqsoff tracer	2025-05-09 15:19:10 -04:00
trace_kdb.c	tracing: kdb: Use tracer_tracing_on/off() instead of setting per CPU disabled	2025-05-09 15:18:47 -04:00
trace_kprobe.c	tracing: probes: Fix a possible race in trace_probe_log APIs	2025-05-13 22:23:34 +09:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_mmiotrace.c	tracing/mmiotrace: Remove reference to unused per CPU data pointer	2025-05-08 09:36:09 -04:00
trace_nop.c
trace_osnoise.c	tracing/osnoise: Allow arbitrarily long CPU string	2025-05-08 09:36:09 -04:00
trace_output.c	tracing: Show preempt and irq events callsites from the offsets in field print	2025-05-06 11:34:52 -04:00
trace_output.h	ftrace: Add print_function_args()	2025-03-04 11:27:23 -05:00
trace_preemptirq.c	tracing: Fix archs that still call tracepoints without RCU watching	2024-12-05 09:28:58 -05:00
trace_printk.c
trace_probe.c	tracing: probes: Fix a possible race in trace_probe_log APIs	2025-05-13 22:23:34 +09:00
trace_probe.h	tracing: probe-events: Log error for exceeding the number of arguments	2025-03-27 21:19:54 +09:00
trace_probe_kernel.h
trace_probe_tmpl.h	tracing/fprobe: Enable fprobe events with CONFIG_DYNAMIC_FTRACE_WITH_ARGS	2024-12-26 10:50:04 -05:00
trace_recursion_record.c
trace_sched_switch.c	pid: allow pid_max to be set per pid namespace	2024-12-02 11:25:25 +01:00
trace_sched_wakeup.c	tracing: Convert the per CPU "disabled" counter to local from atomic	2025-05-09 15:19:10 -04:00
trace_selftest.c	fgraph: Pass ftrace_regs to retfunc	2024-12-26 10:50:03 -05:00
trace_selftest_dynamic.c
trace_seq.c
trace_stack.c	tracing updates for v6.16:	2025-05-29 21:04:36 -07:00
trace_stat.c	tracing: Switch trace_stat.c code over to use guard()	2024-12-26 10:38:37 -05:00
trace_stat.h
trace_synth.h
trace_syscalls.c	tracing/perf: Add might_fault check to syscall probes	2024-10-09 17:09:46 -04:00
trace_uprobe.c	bpf-next-6.16	2025-05-28 15:52:42 -07:00
tracing_map.c	tracing: Fix cmp_entries_dup() to respect sort() comparison rules	2024-12-04 10:38:24 -05:00
tracing_map.h