[ upstream commit
40ee4dffff061399eb9358e0c8fcfbaf8de4c8fe ]
file
The "enable" file for the event system can be removed when a module
is unloaded and the event system only has events from that module.
As the event system nr_events count goes to zero, it may be freed
if its ref_count is also set to zero.
Like the "filter" file, the "enable" file may be opened by a task and
referenced later, after a module has been unloaded and the events for
that event system have been removed.
Although the "filter" file referenced the event system structure,
the "enable" file only references a pointer to the event system
name. Since the name is freed when the event system is removed,
it is possible that an access to the "enable" file may reference
a freed pointer.
Update the "enable" file to use the subsystem_open() routine that
the "filter" file uses, to keep a reference to the event system
structure while the "enable" file is opened.
Cc: <stable@kernel.org>
Reported-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
loff_t *ppos)
{
const char set_to_char[4] = { '?', '0', '1', 'X' };
loff_t *ppos)
{
const char set_to_char[4] = { '?', '0', '1', 'X' };
- const char *system = filp->private_data;
+ struct event_subsystem *system = filp->private_data;
struct ftrace_event_call *call;
char buf[2];
int set = 0;
struct ftrace_event_call *call;
char buf[2];
int set = 0;
(!call->class->probe && !call->class->reg))
continue;
(!call->class->probe && !call->class->reg))
continue;
- if (system && strcmp(call->class->system, system) != 0)
+ if (system && strcmp(call->class->system, system->name) != 0)
system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
loff_t *ppos)
{
system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
loff_t *ppos)
{
- const char *system = filp->private_data;
+ struct event_subsystem *system = filp->private_data;
+ const char *name = NULL;
unsigned long val;
char buf[64];
ssize_t ret;
unsigned long val;
char buf[64];
ssize_t ret;
if (val != 0 && val != 1)
return -EINVAL;
if (val != 0 && val != 1)
return -EINVAL;
- ret = __ftrace_set_clr_event(NULL, system, NULL, val);
+ /*
+ * Opening of "enable" adds a ref count to system,
+ * so the name is safe to use.
+ */
+ if (system)
+ name = system->name;
+
+ ret = __ftrace_set_clr_event(NULL, name, NULL, val);
struct event_subsystem *system = NULL;
int ret;
struct event_subsystem *system = NULL;
int ret;
+ if (!inode->i_private)
+ goto skip_search;
+
/* Make sure the system still exists */
mutex_lock(&event_mutex);
list_for_each_entry(system, &event_subsystems, list) {
/* Make sure the system still exists */
mutex_lock(&event_mutex);
list_for_each_entry(system, &event_subsystems, list) {
if (system != inode->i_private)
return -ENODEV;
if (system != inode->i_private)
return -ENODEV;
ret = tracing_open_generic(inode, filp);
ret = tracing_open_generic(inode, filp);
put_system(system);
return ret;
put_system(system);
return ret;
{
struct event_subsystem *system = inode->i_private;
{
struct event_subsystem *system = inode->i_private;
+ if (system)
+ put_system(system);
};
static const struct file_operations ftrace_system_enable_fops = {
};
static const struct file_operations ftrace_system_enable_fops = {
- .open = tracing_open_generic,
+ .open = subsystem_open,
.read = system_enable_read,
.write = system_enable_write,
.read = system_enable_read,
.write = system_enable_write,
+ .release = subsystem_release,
};
static const struct file_operations ftrace_show_header_fops = {
};
static const struct file_operations ftrace_show_header_fops = {
"'%s/filter' entry\n", name);
}
"'%s/filter' entry\n", name);
}
- trace_create_file("enable", 0644, system->entry,
- (void *)system->name,
+ trace_create_file("enable", 0644, system->entry, system,
&ftrace_system_enable_fops);
return system->entry;
&ftrace_system_enable_fops);
return system->entry;