The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [PATCH v2] tracing: Add mutex to trace_parser to fix concurrent write races
@ 2026-07-15  8:19 Tengda Wu
  2026-07-23  0:52 ` Steven Rostedt
  0 siblings, 1 reply; 3+ messages in thread
From: Tengda Wu @ 2026-07-15  8:19 UTC (permalink / raw)
  To: Steven Rostedt, Masami Hiramatsu
  Cc: Mark Rutland, Mathieu Desnoyers, linux-trace-kernel, linux-kernel,
	Tengda Wu

The trace_parser structure is allocated and initialized when a trace
file is opened, and is subsequently used in the write handler to parse
user input. If userspace opens a trace file descriptor and shares it
across multiple threads, concurrent write calls will race on the
parser's internal state, specifically the idx, cont, and buffer fields,
leading to corrupted input or undefined behavior.

Fix this by embedding a mutex directly in struct trace_parser. The mutex
is initialized in trace_parser_get_init() and destroyed in
trace_parser_put(). All write-side users that access parser state
(trace_get_user() followed by checking trace_parser_loaded() /
trace_parser_cont() against the buffer) now hold the mutex across the
full critical section, avoiding any TOCTOU gap between the parse and the
subsequent consumption of parser->buffer.

Fixes: e704eff3ff51 ("ftrace: Have set_graph_function handle multiple functions in one write")
Fixes: 689fd8b65d66 ("tracing: trace parser support for function and graph")
Cc: stable@vger.kernel.org
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
---
v2: Add proper lockdep assertions to enforce that the parser lock is
    held by all callers (Steven).
v1: https://lore.kernel.org/all/20260713134640.708323-1-wutengda@huaweicloud.com/

 kernel/trace/ftrace.c       | 7 +++++++
 kernel/trace/trace.c        | 4 ++++
 kernel/trace/trace.h        | 5 +++++
 kernel/trace/trace_events.c | 2 ++
 kernel/trace/trace_pid.c    | 2 ++
 5 files changed, 20 insertions(+)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f93e34dd2328..ef47e5659283 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5842,6 +5842,8 @@ ftrace_regex_write(struct file *file, const char __user *ubuf,
 	/* iter->hash is a local copy, so we don't need regex_lock */
 
 	parser = &iter->parser;
+
+	guard(mutex)(&parser->lock);
 	read = trace_get_user(parser, ubuf, cnt, ppos);
 
 	if (read >= 0 && trace_parser_loaded(parser) &&
@@ -6984,12 +6986,14 @@ int ftrace_regex_release(struct inode *inode, struct file *file)
 		iter = file->private_data;
 
 	parser = &iter->parser;
+	mutex_lock(&parser->lock);
 	if (trace_parser_loaded(parser)) {
 		int enable = !(iter->flags & FTRACE_ITER_NOTRACE);
 
 		ftrace_process_regex(iter, parser->buffer,
 				     parser->idx, enable);
 	}
+	mutex_unlock(&parser->lock);
 
 	trace_parser_put(parser);
 
@@ -7321,10 +7325,12 @@ ftrace_graph_release(struct inode *inode, struct file *file)
 
 		parser = &fgd->parser;
 
+		mutex_lock(&parser->lock);
 		if (trace_parser_loaded((parser))) {
 			ret = ftrace_graph_set_hash(fgd->new_hash,
 						    parser->buffer);
 		}
+		mutex_unlock(&parser->lock);
 
 		trace_parser_put(parser);
 
@@ -7437,6 +7443,7 @@ ftrace_graph_write(struct file *file, const char __user *ubuf,
 
 	parser = &fgd->parser;
 
+	guard(mutex)(&parser->lock);
 	read = trace_get_user(parser, ubuf, cnt, ppos);
 
 	if (read >= 0 && trace_parser_loaded(parser) &&
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1146b83b711a..255432879847 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -1100,6 +1100,7 @@ int trace_parser_get_init(struct trace_parser *parser, int size)
 		return 1;
 
 	parser->size = size;
+	mutex_init(&parser->lock);
 	return 0;
 }
 
@@ -1108,6 +1109,7 @@ int trace_parser_get_init(struct trace_parser *parser, int size)
  */
 void trace_parser_put(struct trace_parser *parser)
 {
+	mutex_destroy(&parser->lock);
 	kfree(parser->buffer);
 	parser->buffer = NULL;
 }
@@ -1130,6 +1132,8 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
 	size_t read = 0;
 	ssize_t ret;
 
+	lockdep_assert_held(&parser->lock);
+
 	if (!*ppos)
 		trace_parser_clear(parser);
 
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 2537c33ddd49..b87baf249eb7 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1387,26 +1387,31 @@ struct trace_parser {
 	char		*buffer;
 	unsigned	idx;
 	unsigned	size;
+	struct mutex	lock;
 };
 
 static inline bool trace_parser_loaded(struct trace_parser *parser)
 {
+	lockdep_assert_held(&parser->lock);
 	return !parser->fail && parser->idx != 0;
 }
 
 static inline bool trace_parser_cont(struct trace_parser *parser)
 {
+	lockdep_assert_held(&parser->lock);
 	return parser->cont;
 }
 
 static inline void trace_parser_clear(struct trace_parser *parser)
 {
+	lockdep_assert_held(&parser->lock);
 	parser->cont = false;
 	parser->idx = 0;
 }
 
 static inline void trace_parser_fail(struct trace_parser *parser)
 {
+	lockdep_assert_held(&parser->lock);
 	parser->fail = true;
 }
 
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index c46e623e7e0d..644e8aad43d4 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1535,6 +1535,7 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
 	if (trace_parser_get_init(&parser, EVENT_BUF_SIZE + 1))
 		return -ENOMEM;
 
+	mutex_lock(&parser.lock);
 	read = trace_get_user(&parser, ubuf, cnt, ppos);
 
 	if (read >= 0 && trace_parser_loaded((&parser))) {
@@ -1551,6 +1552,7 @@ ftrace_event_write(struct file *file, const char __user *ubuf,
 	ret = read;
 
  out_put:
+	mutex_unlock(&parser.lock);
 	trace_parser_put(&parser);
 
 	return ret;
diff --git a/kernel/trace/trace_pid.c b/kernel/trace/trace_pid.c
index 7127c8de4174..f438291ee3b0 100644
--- a/kernel/trace/trace_pid.c
+++ b/kernel/trace/trace_pid.c
@@ -195,6 +195,7 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
 	}
 
 	ret = 0;
+	mutex_lock(&parser.lock);
 	while (cnt > 0) {
 
 		pos = 0;
@@ -225,6 +226,7 @@ int trace_pid_write(struct trace_pid_list *filtered_pids,
 		trace_parser_clear(&parser);
 		ret = 0;
 	}
+	mutex_unlock(&parser.lock);
  out:
 	trace_parser_put(&parser);
 
-- 
2.34.1


^ permalink raw reply related	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-23  2:55 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-15  8:19 [PATCH v2] tracing: Add mutex to trace_parser to fix concurrent write races Tengda Wu
2026-07-23  0:52 ` Steven Rostedt
2026-07-23  2:55   ` Tengda Wu

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox