From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Andrew Morton <akpm@linux-foundation.org>,
Zheng Yejian <zhengyejian1@huawei.com>,
Naresh Kamboju <naresh.kamboju@linaro.org>
Subject: [PATCH 0/6] tracing: Fix removing instances while reading/writing to their files
Date: Wed, 06 Sep 2023 22:47:10 -0400 [thread overview]
Message-ID: <20230907024710.866917011@goodmis.org> (raw)
It appears that the dynamic code of eventfs has caused a race window
to open up a bit more and showed that several files were not protected
by the trace array ref count. This means that a task could open one
of the files in an instance, remove the instance, and still be able to
read or write to that file. That access will then cause a "use-after-free"
bug.
Close those holes!
Also, fix a left over unused variable in the eventfs dput fix.
Steven Rostedt (Google) (6):
tracefs/eventfs: Use dput to free the toplevel events directory
tracing: Increase trace array ref count on enable and filter files
tracing: Have tracing_max_latency inc the trace array ref count
tracing: Have current_trace inc the trace array ref count
tracing: Have option files inc the trace array ref count
tracing: Have event inject files inc the trace array ref count
----
fs/tracefs/event_inode.c | 17 +++++++---
fs/tracefs/inode.c | 2 +-
fs/tracefs/internal.h | 5 +--
kernel/trace/trace.c | 68 ++++++++++++++++++++++++++++++++++----
kernel/trace/trace.h | 2 ++
kernel/trace/trace_events.c | 6 ++--
kernel/trace/trace_events_inject.c | 3 +-
7 files changed, 85 insertions(+), 18 deletions(-)
next reply other threads:[~2023-09-07 2:47 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-07 2:47 Steven Rostedt [this message]
2023-09-07 2:47 ` [PATCH 1/6] tracefs/eventfs: Use dput to free the toplevel events directory Steven Rostedt
2023-09-07 17:48 ` Ajay Kaher
2023-09-07 19:39 ` Steven Rostedt
2023-09-07 21:56 ` Steven Rostedt
2023-09-08 7:45 ` Masami Hiramatsu
2023-09-09 3:09 ` Steven Rostedt
2023-09-07 2:47 ` [PATCH 2/6] tracing: Increase trace array ref count on enable and filter files Steven Rostedt
2023-09-07 2:47 ` [PATCH 3/6] tracing: Have tracing_max_latency inc the trace array ref count Steven Rostedt
2023-09-07 2:47 ` [PATCH 4/6] tracing: Have current_trace " Steven Rostedt
2023-09-07 2:47 ` [PATCH 5/6] tracing: Have option files " Steven Rostedt
2023-09-07 2:47 ` [PATCH 6/6] tracing: Have event inject " Steven Rostedt
2023-09-07 13:24 ` [PATCH 0/6] tracing: Fix removing instances while reading/writing to their files Naresh Kamboju
2023-09-07 16:11 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230907024710.866917011@goodmis.org \
--to=rostedt@goodmis.org \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mhiramat@kernel.org \
--cc=naresh.kamboju@linaro.org \
--cc=zhengyejian1@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).