In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Free histogram the field rejected for a bad modifier<\/p>\n
Writing a hist trigger whose value or variable carries a modifier that is
\nnot allowed there leaks the fields that were built for it.<\/p>\n
__create_val_field() takes the field from parse_expr() and stores it in
\nhist_data->fields[] only after the modifier checks have run:<\/p>\n
\thist_field = parse_expr(hist_data, file, field_str, flags, var_name,
\n\t\t\t\t&n_subexprs);
\n\t…
\n\tif (hist_field->flags & HIST_FIELD_FL_VAR) {
\n\t\tif (hist_field->flags & (…))
\n\t\t\tgoto err;
\n\t} else {
\n\t\tif (hist_field->flags & (…))
\n\t\t\tgoto err;
\n\t}<\/p>\n
\thist_data->fields[val_idx] = hist_field;<\/p>\n
Both checks jump past that store, and the err label returns without
\nfreeing anything. The error unwinds to create_hist_data(), which calls
\ndestroy_hist_data() -> destroy_hist_fields(), and that reaches a field
\nonly by walking fields[]. A field that never got there is unreachable.<\/p>\n
commit e0213434fe3e (“tracing: Do not let histogram values have some
\nmodifiers”) set ret to -EINVAL and fell through to the store, which left
\nthe field owned by fields[] and freed along with the rest of hist_data.
\nSplitting the check into a value case and a variable case replaced that
\nfall-through with a goto that skips it.<\/p>\n
With CONFIG_DEBUG_KMEMLEAK, 200 writes of<\/p>\n
# echo ‘hist:keys=prev_pid:vals=next_pid.log2’ >
\n\t events\/sched\/sched_switch\/trigger<\/p>\n
each correctly rejected with -EINVAL, leave 332 unreferenced objects
\n(63744 bytes) reported at create_hist_field(); 200 install and remove
\ncycles of a valid trigger leave none. A ‘.log2’ field is two
\nallocations, since create_hist_field() puts the plain field in
\noperands[0] of the log2 field, and both are reported.<\/p>\n
Use destroy_hist_field() rather than __destroy_hist_field() so that
\noperands[0] is freed as well. It returns early for HIST_FIELD_FL_VAR_REF,
\nwhich is what an operand owned by hist_data->var_refs[] needs; the
\nrejected field itself is never a var ref, because a var ref never carries
\na modifier flag.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Free histogram the field rejected for a bad modifier<\/p>\n
Writing a hist trigger whose value or variable carries a modifier th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29077","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}