From 6a8312ceddea9061aa84e3d3882cf926c1caabc1 Mon Sep 17 00:00:00 2001 From: Hao Zeng Date: Tue, 23 Sep 2025 14:18:09 +0800 Subject: [PATCH] recordmcount: Fix memory leaks in the uwrite function stable inclusion from stable-v4.19.284 commit 444ec005404cead222ebce2561a9451c9ee5ad89 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVX CVE: CVE-2023-53318 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=444ec005404cead222ebce2561a9451c9ee5ad89 -------------------------------- [ Upstream commit fa359d068574d29e7d2f0fdd0ebe4c6a12b5cfb9 ] Common realloc mistake: 'file_append' nulled but not freed upon failure Link: https://lkml.kernel.org/r/20230426010527.703093-1-zenghao@kylinos.cn Signed-off-by: Hao Zeng Suggested-by: Steven Rostedt Signed-off-by: Steven Rostedt (Google) Signed-off-by: Sasha Levin Signed-off-by: Liu Kai --- scripts/recordmcount.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c index 4182274a5ab2..ff481b4ae85f 100644 --- a/scripts/recordmcount.c +++ b/scripts/recordmcount.c @@ -128,6 +128,7 @@ uwrite(int const fd, void const *const buf, size_t const count) { size_t cnt = count; off_t idx = 0; + void *p = NULL; file_updated = 1; @@ -135,7 +136,10 @@ uwrite(int const fd, void const *const buf, size_t const count) off_t aoffset = (file_ptr + count) - file_end; if (aoffset > file_append_size) { - file_append = realloc(file_append, aoffset); + p = realloc(file_append, aoffset); + if (!p) + free(file_append); + file_append = p; file_append_size = aoffset; } if (!file_append) { -- Gitee