lkml.org 
[lkml]   [2013]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v4 11/11] tracing: change event_trigger_open to verify i_private != NULL
Date
Similar to the other fixes for the same thing elsewhere by Oleg
Nesterov...

event_trigger_regex_open() is racy, ftrace_event_file can be already
freed by rmdir or trace_remove_event_call().

Change event_trigger_open() to read and verify "file = i_private"
under event_mutex.

This also moves event_file_data() into trace.h so it can be used
outside of trace_events.c.

Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
---
kernel/trace/trace.h | 4 ++++
kernel/trace/trace_events.c | 5 -----
kernel/trace/trace_events_trigger.c | 7 ++++++-
3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index c56a773..a6ef810 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1023,6 +1023,10 @@ extern int event_trace_del_tracer(struct trace_array *tr);
extern struct ftrace_event_file *find_event_file(struct trace_array *tr,
const char *system,
const char *event);
+static inline void *event_file_data(struct file *filp)
+{
+ return ACCESS_ONCE(file_inode(filp)->i_private);
+}

extern struct mutex event_mutex;
extern struct list_head ftrace_events;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 6b4cb04..a444f65 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -427,11 +427,6 @@ static void remove_subsystem(struct ftrace_subsystem_dir *dir)
}
}

-static void *event_file_data(struct file *filp)
-{
- return ACCESS_ONCE(file_inode(filp)->i_private);
-}
-
static void remove_event_file_dir(struct ftrace_event_file *file)
{
struct dentry *dir = file->dir;
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 54112be..011bdfb 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -133,7 +133,12 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file)

mutex_lock(&event_mutex);

- iter->file = inode->i_private;
+ iter->file = event_file_data(file);
+ if (!iter->file) {
+ kfree(iter);
+ mutex_unlock(&event_mutex);
+ return -ENODEV;
+ }

if (file->f_mode & FMODE_READ) {
ret = seq_open(file, &event_triggers_seq_ops);
--
1.7.11.4


\
 
 \ /
  Last update: 2013-07-29 21:01    [W:0.134 / U:0.100 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site