Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [Critical] Use-after-free in trace_options_core_read and trace_options_core_write due to missing trace_array reference. -- commit ea5806b528a93a9450975f8b2320a019a3fbc9c7 Author: Steven Rostedt <[email protected]> tracing: Have show_event_filters/triggers files take trace array ref This commit fixes a use-after-free issue when reading show_event_filters or show_event_triggers files by ensuring their open operations take a reference on the trace array. This prevents the trace array from being freed via rmdir while a task is still reading the files. Closes: https://lore.kernel.org/all/ca+0ovcjerkzjlwxscm9bf2ga2rli4_xopufk41ndbenpeu9...@mail.gmail.com/ > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 9f8f2d02276ca..e676601943362 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c [ ... ] > @@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct file > *file) > static int > ftrace_event_show_filters_open(struct inode *inode, struct file *file) > { > - return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); > + struct trace_array *tr = inode->i_private; > + int ret; > + > + ret = tracing_check_open_get_tr(tr); [Severity: Critical] This isn't a bug introduced by this patch, but since we are fixing missing trace array references, does a similar use-after-free exist for the trace options files? Looking at trace_options_core_fops in kernel/trace/trace.c, it registers tracing_open_generic() as the open handler. That function passes NULL to tracing_check_open_get_tr(), bypassing the trace_array_get() call: kernel/trace/trace.c:tracing_open_generic() { int ret; ret = tracing_check_open_get_tr(NULL); if (ret) return ret; filp->private_data = inode->i_private; return 0; } Because no reference is taken on the trace array, could a user remove the trace instance via rmdir while holding the options file open, and then trigger a use-after-free when reading or writing? For example, trace_options_core_read() retrieves the freed trace_array via get_tr_index() and immediately dereferences it: kernel/trace/trace.c:trace_options_core_read() { ... get_tr_index(tr_index, &tr, &index); if (tr->trace_flags & (1ULL << index)) ... } > + if (ret) > + return ret; > + > + ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); > + if (ret < 0) > + trace_array_put(tr); > + return ret; > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
