epoch: Fix use-after-free in epoch_trace_report()HEADmain

epoch_trace_report() assigned the return value of RB_INSERT() back to
the new element. When two threads report the same stack concurrently,
the loser's RB_INSERT() returns the element already in the tree, and
that element was freed while still linked, leaking the new allocation.
The next lookup touches freed memory; KASAN catches it as a
use-after-free.

Keep the return value separate and free the new element instead. The
thread that won the race prints the report, so return without printing
it a second time.

Reviewed by:		markj
Fixes:			173c062a569b ("Improve EPOCH_TRACE")
MFC after:		1 week
Sponsored by:		Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D60162

0 files changed, 0 insertions, 0 deletions