Patch "tracing: Fix freeing of filter in create_filter() when set_str is false" has been added to the 4.12-stable tree

This is a note to let you know that I've just added the patch titled

tracing: Fix freeing of filter in create_filter() when set_str is false

to the 4.12-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tracing-fix-freeing-of-filter-in-create_filter-when-set_str-is-false.patch
and it can be found in the queue-4.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: "Steven Rostedt (VMware)" <[email protected]>
Date: Wed, 23 Aug 2017 12:46:27 -0400
Subject: tracing: Fix freeing of filter in create_filter() when set_str is false

From: Steven Rostedt (VMware) <[email protected]>

commit 8b0db1a5bdfcee0dbfa89607672598ae203c9045 upstream.

Performing the following task with kmemleak enabled:

 # cd /sys/kernel/tracing/events/irq/irq_handler_entry/
 # echo 'enable_event:kmem:kmalloc:3 if irq >' > trigger
 # echo 'enable_event:kmem:kmalloc:3 if irq > 31' > trigger
 # echo scan > /sys/kernel/debug/kmemleak
 # cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8800b9290308 (size 32):
  comm "bash", pid 1114, jiffies 4294848451 (age 141.139s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81cef5aa>] kmemleak_alloc+0x4a/0xa0
    [<ffffffff81357938>] kmem_cache_alloc_trace+0x158/0x290
    [<ffffffff81261c09>] create_filter_start.constprop.28+0x99/0x940
    [<ffffffff812639c9>] create_filter+0xa9/0x160
    [<ffffffff81263bdc>] create_event_filter+0xc/0x10
    [<ffffffff812655e5>] set_trigger_filter+0xe5/0x210
    [<ffffffff812660c4>] event_enable_trigger_func+0x324/0x490
    [<ffffffff812652e2>] event_trigger_write+0x1a2/0x260
    [<ffffffff8138cf87>] __vfs_write+0xd7/0x380
    [<ffffffff8138f421>] vfs_write+0x101/0x260
    [<ffffffff8139187b>] SyS_write+0xab/0x130
    [<ffffffff81cfd501>] entry_SYSCALL_64_fastpath+0x1f/0xbe
    [<ffffffffffffffff>] 0xffffffffffffffff

The function create_filter() is passed a 'filterp' pointer that gets allocated, and if "set_str" is true, it is up to the caller to free it, even on error. The problem is that the pointer is not freed by create_filter() when set_str is false. This is a bug, and it is not up to the caller to free the filter on error if it doesn't care about the string.

---
 kernel/trace/trace_events_filter.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -1959,6 +1959,10 @@ static int create_filter(struct trace_ev
 		if (err && set_str)
 			append_filter_err(ps, filter);
 	}
+	if (err && !set_str) {
+		free_event_filter(filter);
+		filter = NULL;
+	}
 	create_filter_finish(ps);
 
 	*filterp = filter;

Patches currently in stable-queue which might be from [email protected] are

queue-4.12/tracing-missing-error-code-in-tracer_alloc_buffers.patch queue-4.12/ring-buffer-have-ring_buffer_alloc_read_page-return-error-on-offline-cpu.patch queue-4.12/ftrace-check-for-null-ret_stack-on-profile-function-graph-entry-function.patch queue-4.12/tracing-fix-freeing-of-filter-in-create_filter-when-set_str-is-false.patch queue-4.12/tracing-call-clear_boot_tracer-at-lateinit_sync.patch queue-4.12/tracing-fix-kmemleak-in-tracing_map_array_free.patch