This is a note to let you know that I've just added the patch titled
perf metricgroup: Fix use after free in metric__new()
to the 5.16-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
perf-metricgroup-fix-use-after-free-in-metric__new.patch
and it can be found in the queue-5.16 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From e000ea0beffb5497425054b151369fe37a792ece Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jose.exposito89@xxxxxxxxx>
Date: Wed, 8 Dec 2021 18:11:13 +0100
Subject: perf metricgroup: Fix use after free in metric__new()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
From: José Expósito <jose.exposito89@xxxxxxxxx>
commit e000ea0beffb5497425054b151369fe37a792ece upstream.
We shouldn't free() something that will be used in the next line, fix
it.
Fixes: b85a4d61d3022608 ("perf metric: Allow modifiers on metrics")
Addresses-Coverity-ID: 1494000
Signed-off-by: José Expósito <jose.exposito89@xxxxxxxxx>
Cc: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx>
Cc: Andi Kleen <ak@xxxxxxxxxxxxxxx>
Cc: Ian Rogers <irogers@xxxxxxxxxx>
Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
Cc: John Garry <john.garry@xxxxxxxxxx>
Cc: Mark Rutland <mark.rutland@xxxxxxx>
Cc: Namhyung Kim <namhyung@xxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Link: http://lore.kernel.org/lkml/20211208171113.22089-1-jose.exposito89@xxxxxxxxx
Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
tools/perf/util/metricgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/util/metricgroup.c
+++ b/tools/perf/util/metricgroup.c
@@ -209,8 +209,8 @@ static struct metric *metric__new(const
m->metric_name = pe->metric_name;
m->modifier = modifier ? strdup(modifier) : NULL;
if (modifier && !m->modifier) {
- free(m);
expr__ctx_free(m->pctx);
+ free(m);
return NULL;
}
m->metric_expr = pe->metric_expr;
Patches currently in stable-queue which might be from jose.exposito89@xxxxxxxxx are
queue-5.16/perf-metricgroup-fix-use-after-free-in-metric__new.patch
queue-5.16/hid-magicmouse-report-battery-level-over-usb.patch
queue-5.16/hid-magicmouse-fix-an-error-handling-path-in-magicmouse_probe.patch
queue-5.16/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-15288
queue-5.16/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch
queue-5.16/hid-apple-do-not-reset-quirks-when-the-fn-key-is-not.patch
queue-5.16/drm-amd-display-fix-dereference-before-null-check.patch
queue-5.16/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-6488
queue-5.16/drm-amd-display-invalid-parameter-check-in-dmub_hpd_.patch
queue-5.16/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-31258
