Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933571Ab2EWCjM (ORCPT ); Tue, 22 May 2012 22:39:12 -0400 Received: from LGEMRELSE1Q.lge.com ([156.147.1.111]:49362 "EHLO LGEMRELSE1Q.lge.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933514Ab2EWCjJ (ORCPT ); Tue, 22 May 2012 22:39:09 -0400 X-AuditID: 9c93016f-b7c3cae000001954-cd-4fbc4dc9f533 From: Namhyung Kim To: Arnaldo Carvalho de Melo Cc: Peter Zijlstra , Paul Mackerras , Ingo Molnar , Namhyung Kim , LKML , Steven Rostedt , Frederic Weisbecker , Ingo Molnar , Arnaldo Carvalho de Melo , Borislav Petkov , David Ahern Subject: [PATCH 12/22] lib/traceevent: Fix a possibly wrong memory dereference Date: Wed, 23 May 2012 11:36:49 +0900 Message-Id: <1337740619-27925-13-git-send-email-namhyung.kim@lge.com> X-Mailer: git-send-email 1.7.10.1 In-Reply-To: <1337740619-27925-1-git-send-email-namhyung.kim@lge.com> References: <1337740619-27925-1-git-send-email-namhyung.kim@lge.com> X-Brightmail-Tracker: AAAAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1457 Lines: 39 If set_op_prio() failed, the token will be freed at out_free, then arg->op.op would turn out to be a dangle pointer. After returning EVENT_ERROR from process_op(), free_arg() will be called and then it will finally see the dangling pointer. Link: http://lkml.kernel.org/r/1333940074-19052-8-git-send-email-namhyung.kim@lge.com Signed-off-by: Namhyung Kim Cc: Frederic Weisbecker Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Cc: Borislav Petkov Cc: David Ahern Signed-off-by: Steven Rostedt --- tools/lib/traceevent/event-parse.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c index 6a8e3169ac68..865d0f268274 100644 --- a/tools/lib/traceevent/event-parse.c +++ b/tools/lib/traceevent/event-parse.c @@ -1747,6 +1747,8 @@ process_op(struct event_format *event, struct print_arg *arg, char **tok) if (set_op_prio(arg) == -1) { event->flags |= EVENT_FL_FAILED; + /* arg->op.op (= token) will be freed at out_free */ + arg->op.op = NULL; goto out_free; } -- 1.7.10.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/