1. Patchew
  2. linux
  3. [PATCH v2 0/4] Clean up access to trace_event_file from a file struct
  4. View patch

[PATCH v2 1/4] tracing: Fix checking of freed trace_event_file for hist files

Petr Pavlu posted 4 patches 1 month ago
There is a newer version of this series
[PATCH v2 1/4] tracing: Fix checking of freed trace_event_file for hist files
Posted by Petr Pavlu 1 month ago 
The event_hist_open() and event_hist_poll() functions currently retrieve
a trace_event_file pointer from a file struct by invoking
event_file_data(), which simply returns file->f_inode->i_private. The
functions then check if the pointer is NULL to determine whether the event
is still valid. This approach is flawed because i_private is assigned when
an eventfs inode is allocated and remains set throughout its lifetime.
Instead, the code should call event_file_file(), which checks for
EVENT_FILE_FL_FREED. Using the incorrect access function may result in the
code potentially opening a hist file for an event that is being removed or
becoming stuck while polling on this file.

A related issue is that although event_hist_poll() attempts to verify
whether an event file is being removed, this check may not occur or could
be unnecessarily delayed. This happens because hist_poll_wakeup() is
currently invoked only from event_hist_trigger() when a hist command is
triggered. If the event file is being removed, no associated hist command
will be triggered and a waiter will be woken up only after an unrelated
hist command is triggered.

Fix these issues by changing the access method to event_file_file() and
adding a call to hist_poll_wakeup() in remove_event_file_dir() after
setting the EVENT_FILE_FL_FREED flag. This ensures that a task polling on
a hist file is woken up and receives EPOLLERR.

Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file")
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
---
 include/linux/trace_events.h     | 5 +++++
 kernel/trace/trace_events.c      | 3 +++
 kernel/trace/trace_events_hist.c | 4 ++--
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 3690221ba3d8..f925034e402d 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -683,6 +683,11 @@ static inline void hist_poll_wakeup(void)
 
 #define hist_poll_wait(file, wait)	\
 	poll_wait(file, &hist_poll_wq, wait)
+
+#else
+static inline void hist_poll_wakeup(void)
+{
+}
 #endif
 
 #define __TRACE_EVENT_FLAGS(name, value)				\
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 137b4d9bb116..e8ed6ba155cf 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file)
 	free_event_filter(file->filter);
 	file->flags |= EVENT_FILE_FL_FREED;
 	event_file_put(file);
+
+	/* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */
+	hist_poll_wakeup();
 }
 
 /*
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index c97bb2fda5c0..744c2aa3d668 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai
 
 	guard(mutex)(&event_mutex);
 
-	event_file = event_file_data(file);
+	event_file = event_file_file(file);
 	if (!event_file)
 		return EPOLLERR;
 
@@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file)
 
 	guard(mutex)(&event_mutex);
 
-	event_file = event_file_data(file);
+	event_file = event_file_file(file);
 	if (!event_file) {
 		ret = -ENODEV;
 		goto err;
-- 
2.52.0
Re: [PATCH v2 1/4] tracing: Fix checking of freed trace_event_file for hist files
Posted by Steven Rostedt 4 weeks, 1 day ago 
On Mon, 16 Feb 2026 14:41:57 +0100
Petr Pavlu <petr.pavlu@suse.com> wrote:

> diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
> index 3690221ba3d8..f925034e402d 100644
> --- a/include/linux/trace_events.h
> +++ b/include/linux/trace_events.h
> @@ -683,6 +683,11 @@ static inline void hist_poll_wakeup(void)
>  
>  #define hist_poll_wait(file, wait)	\
>  	poll_wait(file, &hist_poll_wq, wait)
> +
> +#else
> +static inline void hist_poll_wakeup(void)
> +{
> +}
>  #endif
>  
>  #define __TRACE_EVENT_FLAGS(name, value)				\
> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 137b4d9bb116..e8ed6ba155cf 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file)
>  	free_event_filter(file->filter);
>  	file->flags |= EVENT_FILE_FL_FREED;
>  	event_file_put(file);
> +
> +	/* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */
> +	hist_poll_wakeup();
>  }
>  
>  /*
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index c97bb2fda5c0..744c2aa3d668 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai
>  
>  	guard(mutex)(&event_mutex);
>  
> -	event_file = event_file_data(file);
> +	event_file = event_file_file(file);
>  	if (!event_file)
>  		return EPOLLERR;
>  
> @@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file)
>  
>  	guard(mutex)(&event_mutex);
>  
> -	event_file = event_file_data(file);
> +	event_file = event_file_file(file);
>  	if (!event_file) {
>  		ret = -ENODEV;
>  		goto err;
> -- 

This should be broken into two different patches. One for the
hist_poll_wakeup() fix, the other to use event_file_file().

-- Steve
Re: [PATCH v2 1/4] tracing: Fix checking of freed trace_event_file for hist files
Posted by Steven Rostedt 4 weeks ago 
On Tue, 17 Feb 2026 10:29:57 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Mon, 16 Feb 2026 14:41:57 +0100
> Petr Pavlu <petr.pavlu@suse.com> wrote:
> 
> > diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
> > index 3690221ba3d8..f925034e402d 100644
> > --- a/include/linux/trace_events.h
> > +++ b/include/linux/trace_events.h
> > @@ -683,6 +683,11 @@ static inline void hist_poll_wakeup(void)
> >  
> >  #define hist_poll_wait(file, wait)	\
> >  	poll_wait(file, &hist_poll_wq, wait)
> > +
> > +#else
> > +static inline void hist_poll_wakeup(void)
> > +{
> > +}
> >  #endif
> >  
> >  #define __TRACE_EVENT_FLAGS(name, value)				\
> > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> > index 137b4d9bb116..e8ed6ba155cf 100644
> > --- a/kernel/trace/trace_events.c
> > +++ b/kernel/trace/trace_events.c
> > @@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file)
> >  	free_event_filter(file->filter);
> >  	file->flags |= EVENT_FILE_FL_FREED;
> >  	event_file_put(file);
> > +
> > +	/* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */
> > +	hist_poll_wakeup();
> >  }
> >  
> >  /*
> > diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> > index c97bb2fda5c0..744c2aa3d668 100644
> > --- a/kernel/trace/trace_events_hist.c
> > +++ b/kernel/trace/trace_events_hist.c
> > @@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai
> >  
> >  	guard(mutex)(&event_mutex);
> >  
> > -	event_file = event_file_data(file);
> > +	event_file = event_file_file(file);
> >  	if (!event_file)
> >  		return EPOLLERR;
> >  
> > @@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file)
> >  
> >  	guard(mutex)(&event_mutex);
> >  
> > -	event_file = event_file_data(file);
> > +	event_file = event_file_file(file);
> >  	if (!event_file) {
> >  		ret = -ENODEV;
> >  		goto err;
> > --   
> 
> This should be broken into two different patches. One for the
> hist_poll_wakeup() fix, the other to use event_file_file().
> 
> -- Steve

Replying with my kernel.org account in case this email ended up in your spam folder.

-- Steve

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.