1. Patchew
  2. linux
  3. View series

[PATCH] tracing: Have show_event_filters/triggers files take trace array ref

Steven Rostedt posted 1 patch 4 weeks, 1 day ago 
kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
[PATCH] tracing: Have show_event_filters/triggers files take trace array ref
Posted by Steven Rostedt 4 weeks, 1 day ago 
From: Steven Rostedt <rostedt@goodmis.org>

The newly added files show_event_filters and show_event_triggers that show
all filters or triggers that are set within the trace array do not take a
reference for the trace array it is showing. Without taking a reference,
the trace_array may be freed via "rmdir" while a task is reading one of
theses files. Those files iterate all the events within an instance
(trace_array) and nothing prevents that instance from being freed while
its data is being read. This causes a use-after-free crash.

Have the open of both those files take the trace_array reference via the
trace_array_get() that prevents the trace_array from being freed while the
files are opened.

Cc: stable@vger.kernel.org
Fixes: 729757b96a662 ("tracing: Add show_event_filters to expose active event filters")
Fixes: 6a80838814eea ("tracing: Add show_event_triggers to expose active event triggers")
Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Closes: https://lore.kernel.org/all/CA+0ovCjerKZJLwXScM9bF2ga2rLi4_XOpUfK41NDbENpeu98jA@mail.gmail.com/
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 1d39eaf6a0f7..9dbc2441763b 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2736,14 +2736,14 @@ static const struct file_operations ftrace_show_event_filters_fops = {
 	.open = ftrace_event_show_filters_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = seq_release,
+	.release = ftrace_event_release,
 };
 
 static const struct file_operations ftrace_show_event_triggers_fops = {
 	.open = ftrace_event_show_triggers_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = seq_release,
+	.release = ftrace_event_release,
 };
 
 static const struct file_operations ftrace_set_event_pid_fops = {
@@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct file *file)
 static int
 ftrace_event_show_filters_open(struct inode *inode, struct file *file)
 {
-	return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+	struct trace_array *tr = inode->i_private;
+	int ret;
+
+	ret = tracing_check_open_get_tr(tr);
+	if (ret)
+		return ret;
+
+	ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+	if (ret < 0)
+		trace_array_put(tr);
+	return ret;
 }
 
 /**
@@ -2922,7 +2932,17 @@ ftrace_event_show_filters_open(struct inode *inode, struct file *file)
 static int
 ftrace_event_show_triggers_open(struct inode *inode, struct file *file)
 {
-	return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
+	struct trace_array *tr = inode->i_private;
+	int ret;
+
+	ret = tracing_check_open_get_tr(tr);
+	if (ret)
+		return ret;
+
+	ret = ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
+	if (ret < 0)
+		trace_array_put(tr);
+	return ret;
 }
 
 static int
-- 
2.53.0
Re: [PATCH] tracing: Have show_event_filters/triggers files take trace array ref
Posted by Aaron Tomlin 4 weeks ago 
On Fri, Aug 28, 2026 at 02:41:53PM +0100, Steven Rostedt wrote:
> From: Steven Rostedt <rostedt@goodmis.org>
> 
> The newly added files show_event_filters and show_event_triggers that show
> all filters or triggers that are set within the trace array do not take a
> reference for the trace array it is showing. Without taking a reference,
> the trace_array may be freed via "rmdir" while a task is reading one of
> theses files. Those files iterate all the events within an instance
> (trace_array) and nothing prevents that instance from being freed while
> its data is being read. This causes a use-after-free crash.
> 
> Have the open of both those files take the trace_array reference via the
> trace_array_get() that prevents the trace_array from being freed while the
> files are opened.
> 
> Cc: stable@vger.kernel.org
> Fixes: 729757b96a662 ("tracing: Add show_event_filters to expose active event filters")
> Fixes: 6a80838814eea ("tracing: Add show_event_triggers to expose active event triggers")
> Reported-by: Farhad Alemi <farhad.alemi@berkeley.edu>
> Closes: https://lore.kernel.org/all/CA+0ovCjerKZJLwXScM9bF2ga2rLi4_XOpUfK41NDbENpeu98jA@mail.gmail.com/
> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> ---
>  kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++----
>  1 file changed, 24 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 1d39eaf6a0f7..9dbc2441763b 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -2736,14 +2736,14 @@ static const struct file_operations ftrace_show_event_filters_fops = {
>  	.open = ftrace_event_show_filters_open,
>  	.read = seq_read,
>  	.llseek = seq_lseek,
> -	.release = seq_release,
> +	.release = ftrace_event_release,
>  };
>  
>  static const struct file_operations ftrace_show_event_triggers_fops = {
>  	.open = ftrace_event_show_triggers_open,
>  	.read = seq_read,
>  	.llseek = seq_lseek,
> -	.release = seq_release,
> +	.release = ftrace_event_release,
>  };
>  
>  static const struct file_operations ftrace_set_event_pid_fops = {
> @@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct file *file)
>  static int
>  ftrace_event_show_filters_open(struct inode *inode, struct file *file)
>  {
> -	return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
> +	struct trace_array *tr = inode->i_private;
> +	int ret;
> +
> +	ret = tracing_check_open_get_tr(tr);
> +	if (ret)
> +		return ret;
> +
> +	ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
> +	if (ret < 0)
> +		trace_array_put(tr);
> +	return ret;
>  }
>  
>  /**
> @@ -2922,7 +2932,17 @@ ftrace_event_show_filters_open(struct inode *inode, struct file *file)
>  static int
>  ftrace_event_show_triggers_open(struct inode *inode, struct file *file)
>  {
> -	return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
> +	struct trace_array *tr = inode->i_private;
> +	int ret;
> +
> +	ret = tracing_check_open_get_tr(tr);
> +	if (ret)
> +		return ret;
> +
> +	ret = ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
> +	if (ret < 0)
> +		trace_array_put(tr);
> +	return ret;
>  }
>  
>  static int
> -- 
> 2.53.0
> 

Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>

-- 
Aaron Tomlin

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.