On Fri, Aug 28, 2026 at 02:41:53PM +0100, Steven Rostedt wrote: > From: Steven Rostedt <[email protected]> > > The newly added files show_event_filters and show_event_triggers that show > all filters or triggers that are set within the trace array do not take a > reference for the trace array it is showing. Without taking a reference, > the trace_array may be freed via "rmdir" while a task is reading one of > theses files. Those files iterate all the events within an instance > (trace_array) and nothing prevents that instance from being freed while > its data is being read. This causes a use-after-free crash. > > Have the open of both those files take the trace_array reference via the > trace_array_get() that prevents the trace_array from being freed while the > files are opened. > > Cc: [email protected] > Fixes: 729757b96a662 ("tracing: Add show_event_filters to expose active event > filters") > Fixes: 6a80838814eea ("tracing: Add show_event_triggers to expose active > event triggers") > Reported-by: Farhad Alemi <[email protected]> > Closes: > https://lore.kernel.org/all/ca+0ovcjerkzjlwxscm9bf2ga2rli4_xopufk41ndbenpeu9...@mail.gmail.com/ > Signed-off-by: Steven Rostedt <[email protected]> > --- > kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++---- > 1 file changed, 24 insertions(+), 4 deletions(-) > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > index 1d39eaf6a0f7..9dbc2441763b 100644 > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -2736,14 +2736,14 @@ static const struct file_operations > ftrace_show_event_filters_fops = { > .open = ftrace_event_show_filters_open, > .read = seq_read, > .llseek = seq_lseek, > - .release = seq_release, > + .release = ftrace_event_release, > }; > > static const struct file_operations ftrace_show_event_triggers_fops = { > .open = ftrace_event_show_triggers_open, > .read = seq_read, > .llseek = seq_lseek, > - .release = seq_release, > + .release = ftrace_event_release, > }; > > static const struct file_operations ftrace_set_event_pid_fops = { > @@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct file > *file) > static int > ftrace_event_show_filters_open(struct inode *inode, struct file *file) > { > - return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); > + struct trace_array *tr = inode->i_private; > + int ret; > + > + ret = tracing_check_open_get_tr(tr); > + if (ret) > + return ret; > + > + ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); > + if (ret < 0) > + trace_array_put(tr); > + return ret; > } > > /** > @@ -2922,7 +2932,17 @@ ftrace_event_show_filters_open(struct inode *inode, > struct file *file) > static int > ftrace_event_show_triggers_open(struct inode *inode, struct file *file) > { > - return ftrace_event_open(inode, file, > &show_show_event_triggers_seq_ops); > + struct trace_array *tr = inode->i_private; > + int ret; > + > + ret = tracing_check_open_get_tr(tr); > + if (ret) > + return ret; > + > + ret = ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops); > + if (ret < 0) > + trace_array_put(tr); > + return ret; > } > > static int > -- > 2.53.0 >
Reviewed-by: Aaron Tomlin <[email protected]> -- Aaron Tomlin
