Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] tracing/osnoise: unconditional osn_reset_cpu corrupts active tracer state --
commit e7bd03b79c8b047561cc86479c9cbb434768ea94 Author: Crystal Wood <[email protected]> tracing/osnoise: Split out per-cpu variable resets Reset per-cpu state every time we stop a kthread or detach an fd, rather than assume everything gets cleaned up properly, and avoiding the need to explicitly zero individual fields. > diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c > index 22263e08b968b..d799c400ed9b7 100644 > --- a/kernel/trace/trace_osnoise.c > +++ b/kernel/trace/trace_osnoise.c [ ... ] > @@ -2695,13 +2691,12 @@ timerlat_fd_read(struct file *file, char __user > *ubuf, size_t count, > static int timerlat_fd_release(struct inode *inode, struct file *file) > { > struct fd_data *fdd = file->private_data; > - struct osnoise_variables *osn_var; > - > - osn_var = cpu_osn_var(fdd->cpu); > + struct osnoise_variables *osn_var = cpu_osn_var(fdd->cpu); > > mutex_lock(&osn_var->lock); > if (fdd == osn_var->fdd) > timerlat_fd_detach(fdd); > + osn_reset_cpu(fdd->cpu); [Severity: High] Does this unconditionally call osn_reset_cpu() even when the file descriptor was already detached? If tracing is stopped and the active file descriptor is detached, userspace can start a new tracing session. This sets osn_var->fdd to a new fdd and arms a new hrtimer on the CPU. If userspace subsequently closes the old, detached file descriptor, timerlat_fd_release() executes, skips timerlat_fd_detach(), and unconditionally calls osn_reset_cpu(). Could this trigger a WARN_ON(osn->fdd) and zero out the tlat->zero and osn->zero structs of the newly active session, corrupting its queued hrtimer and potentially causing memory corruption or a kernel panic? > mutex_unlock(&osn_var->lock); > > kfree(fdd); -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=7
