github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tracing: Delay module ref count for "enable_event" trigger

Browse Source 
Triggers are now delayed from freeing, but can still be triggered until
after the RCU grace period has ended. The freeing of the enable_event data
is put into the private_data_free() callback, but the put of the module
refcount is done immediately.

It is possible that if a module is removed that has an event that would
enable (or disable) it is still active, it can read the data of the module
after it is removed causing a use-after-free bug.

Move the trace_event_put_ref() that releases the module into the delayed
callback so that the module can not be removed until any reference to its
events are finished.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
Fixes: 61d445af0a ("tracing: Add bulk garbage collection of freeing event_trigger_data")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
Steven Rostedt 2026-07-24 13:24:15 -04:00
parent 7909781215
commit e091351b38
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/trace/trace_events_trigger.c
View File

@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m,
static void enable_trigger_private_data_free(struct event_trigger_data *data)
{
kfree(data->private_data);
struct enable_trigger_data *enable_data = data->private_data;
trace_event_put_ref(enable_data->file->event_call);
kfree(enable_data);
}
void event_enable_trigger_free(struct event_trigger_data *data)
@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_data *data)
/* Remove the SOFT_MODE flag */
trace_event_enable_disable(enable_data->file, 0, 1);
data->private_data_free = enable_trigger_private_data_free;
trace_event_put_ref(enable_data->file->event_call);
trigger_data_free(data);
}
}