On Tue, 10 Feb 2026 12:28:16 +0100 Petr Pavlu <[email protected]> wrote:
> The event_hist_open() and event_hist_poll() functions currently retrieve > a trace_event_file pointer from a file struct by invoking > event_file_data(), which simply returns file->f_inode->i_private. The > functions then check if the pointer is NULL to determine whether the event > is still valid. This approach is flawed because i_private is assigned when > an eventfs inode is allocated and remains set throughout its lifetime. > Instead, the code should call event_file_file(), which checks for > EVENT_FILE_FL_FREED. Using the incorrect access function may result in the > code potentially opening a hist file for an event that is being removed or > becoming stuck while polling on this file. > > A related issue is that although event_hist_poll() attempts to verify > whether an event file is being removed, this check may not occur or could > be unnecessarily delayed. This happens because hist_poll_wakeup() is > currently invoked only from event_hist_trigger() when a hist command is > triggered. If the event file is being removed, no associated hist command > will be triggered and a waiter will be woken up only after an unrelated > hist command is triggered. > > Fix these issues by changing the access method to event_file_file() and > adding a call to hist_poll_wakeup() in remove_event_file_dir() after > setting the EVENT_FILE_FL_FREED flag. This ensures that a task polling on > a hist file is woken up and receives EPOLLERR. > Thanks for fixing! Acked-by: Masami Hiramatsu (Google) <[email protected]> > Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file") > Signed-off-by: Petr Pavlu <[email protected]> > --- > kernel/trace/trace_events.c | 3 +++ > kernel/trace/trace_events_hist.c | 4 ++-- > 2 files changed, 5 insertions(+), 2 deletions(-) > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 137b4d9bb116..e8ed6ba155cf 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct > trace_event_file *file) > free_event_filter(file->filter); > file->flags |= EVENT_FILE_FL_FREED; > event_file_put(file); > + > + /* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */ > + hist_poll_wakeup(); > } > > /* > diff --git a/kernel/trace/trace_events_hist.c > b/kernel/trace/trace_events_hist.c > index c97bb2fda5c0..744c2aa3d668 100644 > --- a/kernel/trace/trace_events_hist.c > +++ b/kernel/trace/trace_events_hist.c > @@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, > struct poll_table_struct *wai > > guard(mutex)(&event_mutex); > > - event_file = event_file_data(file); > + event_file = event_file_file(file); > if (!event_file) > return EPOLLERR; > > @@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct > file *file) > > guard(mutex)(&event_mutex); > > - event_file = event_file_data(file); > + event_file = event_file_file(file); > if (!event_file) { > ret = -ENODEV; > goto err; > -- > 2.52.0 > -- Masami Hiramatsu (Google) <[email protected]>
