linux-trace-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Steven Rostedt <rostedt@goodmis.org>
To: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Zheng Yejian <zhengyejian1@huawei.com>,
	Naresh Kamboju <naresh.kamboju@linaro.org>,
	stable@vger.kernel.org
Subject: [PATCH 4/6] tracing: Have current_trace inc the trace array ref count
Date: Wed, 06 Sep 2023 22:47:14 -0400	[thread overview]
Message-ID: <20230907024803.877687227@goodmis.org> (raw)
In-Reply-To: 20230907024710.866917011@goodmis.org

From: "Steven Rostedt (Google)" <rostedt@goodmis.org>

The current_trace updates the trace array tracer. For an instance, if the
file is opened and the instance is deleted, reading or writing to the file
will cause a use after free.

Up the ref count of the trace array when current_trace is opened.

Link: https://lore.kernel.org/all/1cb3aee2-19af-c472-e265-05176fe9bd84@huawei.com/

Cc: stable@vger.kernel.org
Fixes: 8530dec63e7b4 ("tracing: Add tracing_check_open_get_tr()")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
 kernel/trace/trace.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c8b8b4c6feaf..b82df33d20ff 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7791,10 +7791,11 @@ static const struct file_operations tracing_max_lat_fops = {
 #endif
 
 static const struct file_operations set_tracer_fops = {
-	.open		= tracing_open_generic,
+	.open		= tracing_open_generic_tr,
 	.read		= tracing_set_trace_read,
 	.write		= tracing_set_trace_write,
 	.llseek		= generic_file_llseek,
+	.release	= tracing_release_generic_tr,
 };
 
 static const struct file_operations tracing_pipe_fops = {
-- 
2.40.1

  parent reply	other threads:[~2023-09-07  2:47 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-09-07  2:47 [PATCH 0/6] tracing: Fix removing instances while reading/writing to their files Steven Rostedt
2023-09-07  2:47 ` [PATCH 1/6] tracefs/eventfs: Use dput to free the toplevel events directory Steven Rostedt
2023-09-07 17:48   ` Ajay Kaher
2023-09-07 19:39     ` Steven Rostedt
2023-09-07 21:56     ` Steven Rostedt
2023-09-08  7:45   ` Masami Hiramatsu
2023-09-09  3:09     ` Steven Rostedt
2023-09-07  2:47 ` [PATCH 2/6] tracing: Increase trace array ref count on enable and filter files Steven Rostedt
2023-09-07  2:47 ` [PATCH 3/6] tracing: Have tracing_max_latency inc the trace array ref count Steven Rostedt
2023-09-07  2:47 ` Steven Rostedt [this message]
2023-09-07  2:47 ` [PATCH 5/6] tracing: Have option files " Steven Rostedt
2023-09-07  2:47 ` [PATCH 6/6] tracing: Have event inject " Steven Rostedt
2023-09-07 13:24 ` [PATCH 0/6] tracing: Fix removing instances while reading/writing to their files Naresh Kamboju
2023-09-07 16:11   ` Steven Rostedt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230907024803.877687227@goodmis.org \
    --to=rostedt@goodmis.org \
    --cc=akpm@linux-foundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=mhiramat@kernel.org \
    --cc=naresh.kamboju@linaro.org \
    --cc=stable@vger.kernel.org \
    --cc=zhengyejian1@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).