On 5/28/19 4:44 PM, Steven Rostedt wrote: > On Tue, 28 May 2019 15:46:59 +0200 > Tomas Bortoli <tomasbort...@gmail.com> wrote: > >> In case of errors, predicate_parse() goes to the out_free label >> to free memory and to return an error code. >> >> However, predicate_parse() does not free the predicates of the >> temporary prog_stack array, thence leaking them. >> >> >> Signed-off-by: Tomas Bortoli <tomasbort...@gmail.com> >> Reported-by: syzbot+6b8e0fb820e570c59...@syzkaller.appspotmail.com >> --- >> kernel/trace/trace_events_filter.c | 4 ++++ >> 1 file changed, 4 insertions(+) >> >> diff --git a/kernel/trace/trace_events_filter.c >> b/kernel/trace/trace_events_filter.c >> index d3e59312ef40..98eafad750d3 100644 >> --- a/kernel/trace/trace_events_filter.c >> +++ b/kernel/trace/trace_events_filter.c >> @@ -433,6 +433,8 @@ predicate_parse(const char *str, int nr_parens, int >> nr_preds, >> parse_error(pe, -ENOMEM, 0); >> goto out_free; >> } >> + memset(prog_stack, 0, nr_preds * sizeof(*prog_stack)); >> + > > Can you instead just switch the allocation of prog_stack to use > kcalloc()?
kmalloc_array() is safe against arithmetic overflow of the arguments. Using kcalloc() directly we wouldn't check for that. Not really ideal in my opinion. And there's no kcalloc_array() apparently! Cheers, Tomas
