An eprobe takes a reference on the call of the event it attaches to,
and kprobe, uprobe, fprobe and synth events all refuse to go away while
trace_event_dyn_busy() says such a reference exists. user_events never
checks it, so a user event can be freed under an eprobe:
echo 'u:test u32 a' >> dynamic_events
echo 'e:ep user_events/test a=$a' >> dynamic_events
echo '-:user_events/test' >> dynamic_events
echo '-:eprobes/ep' >> dynamic_events
The last write drops the reference on the freed call.
Return -EBUSY from destroy_user_event() in that case.
Fixes: 7f5a08c79df3 ("user_events: Add minimal support for trace_event into
ftrace")
Cc: [email protected]
Signed-off-by: David Carlier <[email protected]>
---
A non-persistent event whose last fd closes while an eprobe
holds it now stays registered after the eprobe is gone. Can follow
up with a retry on the eprobe put if wanted.
kernel/trace/trace_events_user.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index f658c3a77aa7..49b857a7f1d7 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c
@@ -1506,6 +1506,10 @@ static int destroy_user_event(struct user_event *user)
lockdep_assert_held(&event_mutex);
+ /* If there is a reference to a dynamic event */
+ if (trace_event_dyn_busy(&user->call))
+ return -EBUSY;
+
/*
* Detach the fields before removing the call. Removing the event
* frees the field list memory (trace_destroy_fields() is run on
--
2.55.0
