CVE-2022-49648

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing/histograms: Fix memory leak problem<br /> <br /> This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.<br /> <br /> As commit 46bbe5c671e0 ("tracing: fix double free") said, the<br /> "double free" problem reported by clang static analyzer is:<br /> &gt; In parse_var_defs() if there is a problem allocating<br /> &gt; var_defs.expr, the earlier var_defs.name is freed.<br /> &gt; This free is duplicated by free_var_defs() which frees<br /> &gt; the rest of the list.<br /> <br /> However, if there is a problem allocating N-th var_defs.expr:<br /> + in parse_var_defs(), the freed &amp;#39;earlier var_defs.name&amp;#39; is<br /> actually the N-th var_defs.name;<br /> + then in free_var_defs(), the names from 0th to (N-1)-th are freed;<br /> <br /> IF ALLOCATING PROBLEM HAPPENED HERE!!! -+<br /> \<br /> |<br /> 0th 1th (N-1)-th N-th V<br /> +-------------+-------------+-----+-------------+-----------<br /> var_defs: | name | expr | name | expr | ... | name | expr | name | ///<br /> +-------------+-------------+-----+-------------+-----------<br /> <br /> These two frees don&amp;#39;t act on same name, so there was no "double free"<br /> problem before. Conversely, after that commit, we get a "memory leak"<br /> problem because the above "N-th var_defs.name" is not freed.<br /> <br /> If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th<br /> var_defs.expr allocated, then execute on shell like:<br /> $ echo &amp;#39;hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc&amp;#39; &gt; \<br /> /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger<br /> <br /> Then kmemleak reports:<br /> unreferenced object 0xffff8fb100ef3518 (size 8):<br /> comm "bash", pid 196, jiffies 4295681690 (age 28.538s)<br /> hex dump (first 8 bytes):<br /> 76 31 00 00 b1 8f ff ff v1......<br /> backtrace:<br /> [] kstrdup+0x2d/0x60<br /> [] event_hist_trigger_parse+0x206f/0x20e0<br /> [] trigger_process_regex+0xc0/0x110<br /> [] event_trigger_write+0x75/0xd0<br /> [] vfs_write+0xbb/0x2a0<br /> [] ksys_write+0x59/0xd0<br /> [] do_syscall_64+0x3a/0x80<br /> [] entry_SYSCALL_64_after_hwframe+0x46/0xb0