tracing/probe: Fix null pointer dereference

xinpengliu · rostedt · commit 19a58ce1dc72 · 2019-08-31T06:51:55.000-04:00
BUG: KASAN: null-ptr-deref in trace_probe_cleanup+0x8d/0xd0 Read of size 8 at addr 0000000000000000 by task syz-executor.0/9746 trace_probe_cleanup+0x8d/0xd0 free_trace_kprobe.part.14+0x15/0x50 alloc_trace_kprobe+0x23e/0x250 Link: http://lkml.kernel.org/r/1565220563-980-1-git-send-email-danielliu861@gmail.com Fixes: e3dc9f8 ("tracing/probe: Add trace_event_call accesses APIs") Signed-off-by: Xinpeng Liu <danielliu861@gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
@@ -895,7 +895,8 @@ void trace_probe_cleanup(struct trace_probe *tp)
 	for (i = 0; i < tp->nr_args; i++)
 		traceprobe_free_probe_arg(&tp->args[i]);
 
-	kfree(call->class->system);
+	if (call->class)
+		kfree(call->class->system);
 	kfree(call->name);
 	kfree(call->print_fmt);
 }

Original file line number	Diff line number	Diff line change
`@@ -895,7 +895,8 @@ void trace_probe_cleanup(struct trace_probe *tp)`
`895`	`895`	`for (i = 0; i < tp->nr_args; i++)`
`896`	`896`	`traceprobe_free_probe_arg(&tp->args[i]);`
`897`	`897`
`898`		`- kfree(call->class->system);`
	`898`	`+ if (call->class)`
	`899`	`+ kfree(call->class->system);`
`899`	`900`	`kfree(call->name);`
`900`	`901`	`kfree(call->print_fmt);`
`901`	`902`	`}`