tracing: Fix possible double free in event_enable_trigger_func()
authorSteven Rostedt (VMware) <rostedt@goodmis.org>
Wed, 25 Jul 2018 20:02:06 +0000 (16:02 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Aug 2018 05:50:21 +0000 (07:50 +0200)
commit10419b0c16d41e7fa3848e83e6bf7521aa9407ef
tree74ae27d3694e14ae862f28c1f32afdc455e2c114
parent9158a7debe5351688515de22fd18a5a8b006f458
tracing: Fix possible double free in event_enable_trigger_func()

commit 15cc78644d0075e76d59476a4467e7143860f660 upstream.

There was a case that triggered a double free in event_trigger_callback()
due to the called reg() function freeing the trigger_data and then it
getting freed again by the error return by the caller. The solution there
was to up the trigger_data ref count.

Code inspection found that event_enable_trigger_func() has the same issue,
but is not as easy to trigger (requires harder to trigger failures). It
needs to be solved slightly different as it needs more to clean up when the
reg() function fails.

Link: http://lkml.kernel.org/r/20180725124008.7008e586@gandalf.local.home
Cc: stable@vger.kernel.org
Fixes: 7862ad1846e99 ("tracing: Add 'enable_event' and 'disable_event' event trigger commands")
Reivewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/trace/trace_events_trigger.c