Messages in this thread | | | Date | Fri, 5 Jul 2013 02:32:23 +0200 | From | Oleg Nesterov <> | Subject | Re: [RFC PATCH] tracing: Atomically get refcounts of event_call and trace_array |
| |
On 07/04, Masami Hiramatsu wrote: > > Currently ftrace_open_generic_file gets an event_file from > inode->i_private, and then locks event_mutex and gets refcount. > However, this can cause a race as below scenario; > > CPU0 CPU1 > open(kprobe_events) > trace_remove_event_call() open(enable) > lock event_mutex get event_file from inode->i_private > event_remove() wait for unlock event_mutex > ... > free event_file > unlock event_mutex > lock event_mutex > add refcount of event_file->call (*) > > So, at (*) point, the event_file is already freed and we > may access the corrupted object.
Yes, but the same can happen with event_call, so it seems that this patch is not enough too.
Say, open(id) can take event_mutex when the caller of trace_remove_event_call() has already freed ftrace_event_call.
Or I missed something...
Perhaps we can rely on d_unlinked() ? IOW, the caller of __ftrace_event_call_get() should take event_mutex, check d_unhashed(f_dentry) and only then do _get().
Nasty, I agree.
Oleg.
| |