The function event_{hist,hist_debug}_open() maintains the refcount of
'file->tr' and 'file' through tracing_open_file_tr(), but it does not
roll back these counts when the subsequent single_open() call fails,
leading to a refcount leak.
A very obvious case is that if the hist/hist_debug file belongs to a
certain instance, the failure of single_open() will prevent the deletion
of that instance, as it relies on the condition 'tr->ref == 1' within
__remove_instance().
Fix this by calling tracing_release_file_tr() to correct the refcount
when single_open() fails.
Fixes: 1cc111b9cddc ("tracing: Fix uaf issue when open the hist or hist_debug
file")
Signed-off-by: Tengda Wu <[email protected]>
Cc: [email protected] # v6.7+
---
kernel/trace/trace_events_hist.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index ad7419e24055..900b06fa8505 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -5702,8 +5702,10 @@ static int event_hist_open(struct inode *inode, struct
file *file)
/* Clear private_data to avoid warning in single_open() */
file->private_data = NULL;
ret = single_open(file, hist_show, hist_file);
- if (ret)
+ if (ret) {
kfree(hist_file);
+ tracing_release_file_tr(inode, file);
+ }
return ret;
}
@@ -5979,7 +5981,10 @@ static int event_hist_debug_open(struct inode *inode,
struct file *file)
/* Clear private_data to avoid warning in single_open() */
file->private_data = NULL;
- return single_open(file, hist_debug_show, file);
+ ret = single_open(file, hist_debug_show, file);
+ if (ret)
+ tracing_release_file_tr(inode, file);
+ return ret;
}
const struct file_operations event_hist_debug_fops = {
--
2.34.1
