Hi Steven, url: https://github.com/0day-ci/linux/commits/Steven-Rostedt/tracing-synthetic-events-Replace-buggy-strcat-with-seq_buf-operations/20201024-071137 base: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 40a03b750bb3ded71a0f21a0b7dfbf3b24068dcb config: i386-randconfig-m021-20201022 (attached as .config) compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <[email protected]> Reported-by: Dan Carpenter <[email protected]> smatch warnings: kernel/trace/trace_events_synth.c:701 parse_synth_field() warn: 'field->type' double freed kernel/trace/trace_events_synth.c:702 parse_synth_field() warn: passing zero to 'ERR_PTR' vim +701 kernel/trace/trace_events_synth.c 726721a51838e39 Tom Zanussi 2020-05-28 582 static struct synth_field *parse_synth_field(int argc, const char **argv, 726721a51838e39 Tom Zanussi 2020-05-28 583 int *consumed) 726721a51838e39 Tom Zanussi 2020-05-28 584 { 726721a51838e39 Tom Zanussi 2020-05-28 585 struct synth_field *field; 726721a51838e39 Tom Zanussi 2020-05-28 586 const char *prefix = NULL, *field_type = argv[0], *field_name, *array; 726721a51838e39 Tom Zanussi 2020-05-28 587 int len, ret = 0; 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 588) struct seq_buf s; 8fbeb52a598c7ab Tom Zanussi 2020-10-04 589 ssize_t size; 726721a51838e39 Tom Zanussi 2020-05-28 590 726721a51838e39 Tom Zanussi 2020-05-28 591 if (field_type[0] == ';') 726721a51838e39 Tom Zanussi 2020-05-28 592 field_type++; 726721a51838e39 Tom Zanussi 2020-05-28 593 726721a51838e39 Tom Zanussi 2020-05-28 594 if (!strcmp(field_type, "unsigned")) { d4d704637d935ef Tom Zanussi 2020-10-13 595 if (argc < 3) { d4d704637d935ef Tom Zanussi 2020-10-13 596 synth_err(SYNTH_ERR_INCOMPLETE_TYPE, errpos(field_type)); 726721a51838e39 Tom Zanussi 2020-05-28 597 return ERR_PTR(-EINVAL); d4d704637d935ef Tom Zanussi 2020-10-13 598 } 726721a51838e39 Tom Zanussi 2020-05-28 599 prefix = "unsigned "; 726721a51838e39 Tom Zanussi 2020-05-28 600 field_type = argv[1]; 726721a51838e39 Tom Zanussi 2020-05-28 601 field_name = argv[2]; 726721a51838e39 Tom Zanussi 2020-05-28 602 *consumed = 3; 726721a51838e39 Tom Zanussi 2020-05-28 603 } else { 726721a51838e39 Tom Zanussi 2020-05-28 604 field_name = argv[1]; 726721a51838e39 Tom Zanussi 2020-05-28 605 *consumed = 2; 726721a51838e39 Tom Zanussi 2020-05-28 606 } 726721a51838e39 Tom Zanussi 2020-05-28 607 726721a51838e39 Tom Zanussi 2020-05-28 608 field = kzalloc(sizeof(*field), GFP_KERNEL); 726721a51838e39 Tom Zanussi 2020-05-28 609 if (!field) 726721a51838e39 Tom Zanussi 2020-05-28 610 return ERR_PTR(-ENOMEM); 726721a51838e39 Tom Zanussi 2020-05-28 611 726721a51838e39 Tom Zanussi 2020-05-28 612 len = strlen(field_name); 726721a51838e39 Tom Zanussi 2020-05-28 613 array = strchr(field_name, '['); 726721a51838e39 Tom Zanussi 2020-05-28 614 if (array) 726721a51838e39 Tom Zanussi 2020-05-28 615 len -= strlen(array); 726721a51838e39 Tom Zanussi 2020-05-28 616 else if (field_name[len - 1] == ';') 726721a51838e39 Tom Zanussi 2020-05-28 617 len--; 726721a51838e39 Tom Zanussi 2020-05-28 618 726721a51838e39 Tom Zanussi 2020-05-28 619 field->name = kmemdup_nul(field_name, len, GFP_KERNEL); 726721a51838e39 Tom Zanussi 2020-05-28 620 if (!field->name) { 726721a51838e39 Tom Zanussi 2020-05-28 621 ret = -ENOMEM; 726721a51838e39 Tom Zanussi 2020-05-28 622 goto free; 726721a51838e39 Tom Zanussi 2020-05-28 623 } 9bbb33291f8e448 Tom Zanussi 2020-10-13 624 if (!is_good_name(field->name)) { d4d704637d935ef Tom Zanussi 2020-10-13 625 synth_err(SYNTH_ERR_BAD_NAME, errpos(field_name)); 9bbb33291f8e448 Tom Zanussi 2020-10-13 626 ret = -EINVAL; 9bbb33291f8e448 Tom Zanussi 2020-10-13 627 goto free; 9bbb33291f8e448 Tom Zanussi 2020-10-13 628 } 726721a51838e39 Tom Zanussi 2020-05-28 629 726721a51838e39 Tom Zanussi 2020-05-28 630 if (field_type[0] == ';') 726721a51838e39 Tom Zanussi 2020-05-28 631 field_type++; 726721a51838e39 Tom Zanussi 2020-05-28 632 len = strlen(field_type) + 1; 10819e25799aae5 Tom Zanussi 2020-10-13 633 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 634) if (array) 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 635) len += strlen(array); 10819e25799aae5 Tom Zanussi 2020-10-13 636 726721a51838e39 Tom Zanussi 2020-05-28 637 if (prefix) 726721a51838e39 Tom Zanussi 2020-05-28 638 len += strlen(prefix); 726721a51838e39 Tom Zanussi 2020-05-28 639 726721a51838e39 Tom Zanussi 2020-05-28 640 field->type = kzalloc(len, GFP_KERNEL); 726721a51838e39 Tom Zanussi 2020-05-28 641 if (!field->type) { 726721a51838e39 Tom Zanussi 2020-05-28 642 ret = -ENOMEM; 726721a51838e39 Tom Zanussi 2020-05-28 643 goto free; 726721a51838e39 Tom Zanussi 2020-05-28 644 } 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 645) seq_buf_init(&s, field->type, len); 726721a51838e39 Tom Zanussi 2020-05-28 646 if (prefix) 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 647) seq_buf_puts(&s, prefix); 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 648) seq_buf_puts(&s, field_type); 726721a51838e39 Tom Zanussi 2020-05-28 649 if (array) { 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 650) seq_buf_puts(&s, array); 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 651) if (s.buffer[s.len - 1] == ';') 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 652) s.len--; 726721a51838e39 Tom Zanussi 2020-05-28 653 } 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 654) if (WARN_ON_ONCE(!seq_buf_buffer_left(&s))) 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 655) goto free; ^^^^^^^^^^ "ret" not set. 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 656) s.buffer[s.len] = '\0'; 726721a51838e39 Tom Zanussi 2020-05-28 657 8fbeb52a598c7ab Tom Zanussi 2020-10-04 658 size = synth_field_size(field->type); bd82631d7ccdc89 Tom Zanussi 2020-10-04 659 if (size < 0) { d4d704637d935ef Tom Zanussi 2020-10-13 660 synth_err(SYNTH_ERR_INVALID_TYPE, errpos(field_type)); bd82631d7ccdc89 Tom Zanussi 2020-10-04 661 ret = -EINVAL; bd82631d7ccdc89 Tom Zanussi 2020-10-04 662 goto free; bd82631d7ccdc89 Tom Zanussi 2020-10-04 663 } else if (size == 0) { bd82631d7ccdc89 Tom Zanussi 2020-10-04 664 if (synth_field_is_string(field->type)) { bd82631d7ccdc89 Tom Zanussi 2020-10-04 665 char *type; bd82631d7ccdc89 Tom Zanussi 2020-10-04 666 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 667) len = sizeof("__data_loc ") + strlen(field->type) + 1; 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 668) type = kzalloc(len, GFP_KERNEL); bd82631d7ccdc89 Tom Zanussi 2020-10-04 669 if (!type) { bd82631d7ccdc89 Tom Zanussi 2020-10-04 670 ret = -ENOMEM; bd82631d7ccdc89 Tom Zanussi 2020-10-04 671 goto free; bd82631d7ccdc89 Tom Zanussi 2020-10-04 672 } bd82631d7ccdc89 Tom Zanussi 2020-10-04 673 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 674) seq_buf_init(&s, type, len); 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 675) seq_buf_puts(&s, "__data_loc "); 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 676) seq_buf_puts(&s, field->type); bd82631d7ccdc89 Tom Zanussi 2020-10-04 677 kfree(field->type); ^^^^^^^^^^^^^^^^^^ Freed. bd82631d7ccdc89 Tom Zanussi 2020-10-04 678 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 679) if (WARN_ON_ONCE(!seq_buf_buffer_left(&s))) 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 680) goto free; ^^^^^^^^^ Double free and "ret" not set. 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 681) s.buffer[s.len] = '\0'; 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 682) 1c7ca34b0b3f131 Steven Rostedt (VMware 2020-10-23 683) field->type = type; bd82631d7ccdc89 Tom Zanussi 2020-10-04 684 field->is_dynamic = true; bd82631d7ccdc89 Tom Zanussi 2020-10-04 685 size = sizeof(u64); bd82631d7ccdc89 Tom Zanussi 2020-10-04 686 } else { d4d704637d935ef Tom Zanussi 2020-10-13 687 synth_err(SYNTH_ERR_INVALID_TYPE, errpos(field_type)); 726721a51838e39 Tom Zanussi 2020-05-28 688 ret = -EINVAL; 726721a51838e39 Tom Zanussi 2020-05-28 689 goto free; 726721a51838e39 Tom Zanussi 2020-05-28 690 } bd82631d7ccdc89 Tom Zanussi 2020-10-04 691 } 8fbeb52a598c7ab Tom Zanussi 2020-10-04 692 field->size = size; 726721a51838e39 Tom Zanussi 2020-05-28 693 726721a51838e39 Tom Zanussi 2020-05-28 694 if (synth_field_is_string(field->type)) 726721a51838e39 Tom Zanussi 2020-05-28 695 field->is_string = true; 726721a51838e39 Tom Zanussi 2020-05-28 696 726721a51838e39 Tom Zanussi 2020-05-28 697 field->is_signed = synth_field_signed(field->type); 726721a51838e39 Tom Zanussi 2020-05-28 698 out: 726721a51838e39 Tom Zanussi 2020-05-28 699 return field; 726721a51838e39 Tom Zanussi 2020-05-28 700 free: 726721a51838e39 Tom Zanussi 2020-05-28 @701 free_synth_field(field); 726721a51838e39 Tom Zanussi 2020-05-28 @702 field = ERR_PTR(ret); 726721a51838e39 Tom Zanussi 2020-05-28 703 goto out; 726721a51838e39 Tom Zanussi 2020-05-28 704 } --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/[email protected]
.config.gz
Description: application/gzip
_______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
