[PATCH v2] tracing: Correct the refcount if the hist/hist_debug file fails to open

[Tengda Wu]

The function event_{hist,hist_debug}_open() maintains the refcount of
'file->tr' and 'file' through tracing_open_file_tr(). However, it does
not roll back these counts on subsequent failure paths, resulting in a
refcount leak.

A very obvious case is that if the hist/hist_debug file belongs to a
specific instance, the refcount leak will prevent the deletion of that
instance, as it relies on the condition 'tr->ref == 1' within
__remove_instance().

Fix this by calling tracing_release_file_tr() on all failure paths in
event_{hist,hist_debug}_open() to correct the refcount.

Fixes: 1cc111b9cddc ("tracing: Fix uaf issue when open the hist or hist_debug 
file")
Signed-off-by: Tengda Wu <wuten...@huaweicloud.com>
Cc: sta...@vger.kernel.org # v6.7+
---
v2: Fix all error path exits after taking the refcount.

 kernel/trace/trace_events_hist.c | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index ad7419e24055..53dc6719181e 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -5689,12 +5689,16 @@ static int event_hist_open(struct inode *inode, struct 
file *file)
        guard(mutex)(&event_mutex);
 
        event_file = event_file_data(file);
-       if (!event_file)
-               return -ENODEV;
+       if (!event_file) {
+               ret = -ENODEV;
+               goto err;
+       }
 
        hist_file = kzalloc(sizeof(*hist_file), GFP_KERNEL);
-       if (!hist_file)
-               return -ENOMEM;
+       if (!hist_file) {
+               ret = -ENOMEM;
+               goto err;
+       }
 
        hist_file->file = file;
        hist_file->last_act = get_hist_hit_count(event_file);
@@ -5702,9 +5706,14 @@ static int event_hist_open(struct inode *inode, struct 
file *file)
        /* Clear private_data to avoid warning in single_open() */
        file->private_data = NULL;
        ret = single_open(file, hist_show, hist_file);
-       if (ret)
+       if (ret) {
                kfree(hist_file);
+               goto err;
+       }
 
+       return 0;
+err:
+       tracing_release_file_tr(inode, file);
        return ret;
 }
 
@@ -5979,7 +5988,10 @@ static int event_hist_debug_open(struct inode *inode, 
struct file *file)
 
        /* Clear private_data to avoid warning in single_open() */
        file->private_data = NULL;
-       return single_open(file, hist_debug_show, file);
+       ret = single_open(file, hist_debug_show, file);
+       if (ret)
+               tracing_release_file_tr(inode, file);
+       return ret;
 }
 
 const struct file_operations event_hist_debug_fops = {
-- 
2.34.1