Commit 10419b0c authored by Steven Rostedt (VMware)'s avatar Steven Rostedt (VMware) Committed by Greg Kroah-Hartman

tracing: Fix possible double free in event_enable_trigger_func()

commit 15cc7864 upstream.

There was a case that triggered a double free in event_trigger_callback()
due to the called reg() function freeing the trigger_data and then it
getting freed again by the error return by the caller. The solution there
was to up the trigger_data ref count.

Code inspection found that event_enable_trigger_func() has the same issue,
but is not as easy to trigger (requires harder to trigger failures). It
needs to be solved slightly different as it needs more to clean up when the
reg() function fails.


Fixes: 7862ad18 ("tracing: Add 'enable_event' and 'disable_event' event trigger commands")
Reivewed-by: default avatarMasami Hiramatsu <>
Signed-off-by: default avatarSteven Rostedt (VMware) <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 9158a7de
......@@ -1396,6 +1396,9 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
goto out;
/* Up the trigger_data count to make sure nothing frees it on failure */
event_trigger_init(trigger_ops, trigger_data);
if (trigger) {
number = strsep(&trigger, ":");
......@@ -1446,6 +1449,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
goto out_disable;
/* Just return zero, not the number of enabled functions */
ret = 0;
event_trigger_free(trigger_ops, trigger_data);
return ret;
......@@ -1456,7 +1460,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops,
if (cmd_ops->set_filter)
cmd_ops->set_filter(NULL, trigger_data, NULL);
event_trigger_free(trigger_ops, trigger_data);
goto out;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment