tracing: Enforce passing in filter=NULL to create_filter()
authorSteven Rostedt (VMware) <rostedt@goodmis.org>
Wed, 11 Apr 2018 14:59:46 +0000 (10:59 -0400)
committerSteven Rostedt (VMware) <rostedt@goodmis.org>
Wed, 11 Apr 2018 15:31:08 +0000 (11:31 -0400)
commit0b3dec05dbbce023f4f25aba975b5d253c313ebb
tree49a5c6fecffa06b5c8333c95c6202f48ec232639
parenta64b2c01e67eff8b8d0d438507fd0346290697cf
tracing: Enforce passing in filter=NULL to create_filter()

There's some inconsistency with what to set the output parameter filterp
when passing to create_filter(..., struct event_filter **filterp).

Whatever filterp points to, should be NULL when calling this function. The
create_filter() calls create_filter_start() with a pointer to a local
"filter" variable that is set to NULL. The create_filter_start() has a
WARN_ON() if the passed in pointer isn't pointing to a value set to NULL.

Ideally, create_filter() should pass the filterp variable it received to
create_filter_start() and not hide it as with a local variable, this allowed
create_filter() to fail, and not update the passed in filter, and the caller
of create_filter() then tried to free filter, which was never initialized to
anything, causing memory corruption.

Link: http://lkml.kernel.org/r/00000000000032a0c30569916870@google.com
Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster")
Reported-by: syzbot+dadcc936587643d7f568@syzkaller.appspotmail.com
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
kernel/trace/trace_events_filter.c