Similar to the other fixes for the same thing elsewhere by Oleg Nesterov...
event_trigger_regex_open() is racy, ftrace_event_file can be already freed by rmdir or trace_remove_event_call(). Change event_trigger_open() to read and verify "file = i_private" under event_mutex. This also moves event_file_data() into trace.h so it can be used outside of trace_events.c. Signed-off-by: Tom Zanussi <[email protected]> --- kernel/trace/trace.h | 4 ++++ kernel/trace/trace_events.c | 5 ----- kernel/trace/trace_events_trigger.c | 7 ++++++- 3 files changed, 10 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index c56a773..a6ef810 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1023,6 +1023,10 @@ extern int event_trace_del_tracer(struct trace_array *tr); extern struct ftrace_event_file *find_event_file(struct trace_array *tr, const char *system, const char *event); +static inline void *event_file_data(struct file *filp) +{ + return ACCESS_ONCE(file_inode(filp)->i_private); +} extern struct mutex event_mutex; extern struct list_head ftrace_events; diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 6b4cb04..a444f65 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -427,11 +427,6 @@ static void remove_subsystem(struct ftrace_subsystem_dir *dir) } } -static void *event_file_data(struct file *filp) -{ - return ACCESS_ONCE(file_inode(filp)->i_private); -} - static void remove_event_file_dir(struct ftrace_event_file *file) { struct dentry *dir = file->dir; diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index 54112be..011bdfb 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -133,7 +133,12 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file) mutex_lock(&event_mutex); - iter->file = inode->i_private; + iter->file = event_file_data(file); + if (!iter->file) { + kfree(iter); + mutex_unlock(&event_mutex); + return -ENODEV; + } if (file->f_mode & FMODE_READ) { ret = seq_open(file, &event_triggers_seq_ops); -- 1.7.11.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
