Re: [PATCH v3 7/9] tracing/osnoise: Split out per-cpu variable resets

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tracing/osnoise: unconditional osn_reset_cpu corrupts active tracer state
--

commit e7bd03b79c8b047561cc86479c9cbb434768ea94
Author: Crystal Wood <crwood@redhat.com>

tracing/osnoise: Split out per-cpu variable resets

Reset per-cpu state every time we stop a kthread or detach an fd, rather
than assume everything gets cleaned up properly, and avoiding the need
to explicitly zero individual fields.

> diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
> index 22263e08b968b..d799c400ed9b7 100644
> --- a/kernel/trace/trace_osnoise.c
> +++ b/kernel/trace/trace_osnoise.c

[ ... ]

> @@ -2695,13 +2691,12 @@ timerlat_fd_read(struct file *file, char __user *ubuf, size_t count,
>  static int timerlat_fd_release(struct inode *inode, struct file *file)
>  {
>  	struct fd_data *fdd = file->private_data;
> -	struct osnoise_variables *osn_var;
> -
> -	osn_var = cpu_osn_var(fdd->cpu);
> +	struct osnoise_variables *osn_var = cpu_osn_var(fdd->cpu);
>  
>  	mutex_lock(&osn_var->lock);
>  	if (fdd == osn_var->fdd)
>  		timerlat_fd_detach(fdd);
> +	osn_reset_cpu(fdd->cpu);

[Severity: High]
Does this unconditionally call osn_reset_cpu() even when the file descriptor
was already detached?

If tracing is stopped and the active file descriptor is detached, userspace
can start a new tracing session. This sets osn_var->fdd to a new fdd and arms
a new hrtimer on the CPU.

If userspace subsequently closes the old, detached file descriptor,
timerlat_fd_release() executes, skips timerlat_fd_detach(), and
unconditionally calls osn_reset_cpu().

Could this trigger a WARN_ON(osn->fdd) and zero out the tlat->zero and
osn->zero structs of the newly active session, corrupting its queued hrtimer
and potentially causing memory corruption or a kernel panic?

>  	mutex_unlock(&osn_var->lock);
>  
>  	kfree(fdd);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014022640.695786-1-crwood@redhat.com?part=7