AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

tracing: Have "enable" file use refcounts like the "filter" file

Browse Source 
The "enable" file for the event system can be removed when a module
is unloaded and the event system only has events from that module.
As the event system nr_events count goes to zero, it may be freed
if its ref_count is also set to zero.

Like the "filter" file, the "enable" file may be opened by a task and
referenced later, after a module has been unloaded and the events for
that event system have been removed.

Although the "filter" file referenced the event system structure,
the "enable" file only references a pointer to the event system
name. Since the name is freed when the event system is removed,
it is possible that an access to the "enable" file may reference
a freed pointer.

Update the "enable" file to use the subsystem_open() routine that
the "filter" file uses, to keep a reference to the event system
structure while the "enable" file is opened.

Cc: <stable@kernel.org>
Reported-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
Steven Rostedt 2011-07-05 14:32:51 -04:00 committed by Steven Rostedt
parent e9dbfae53e
commit 40ee4dffff
1 changed files with 22 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
kernel/trace/trace_events.c
View File

@ -557,7 +557,7 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
loff_t *ppos) loff_t *ppos)
{ {
const char set_to_char[4] = { '?', '0', '1', 'X' }; const char set_to_char[4] = { '?', '0', '1', 'X' };
const char *system = filp->private_data; struct event_subsystem *system = filp->private_data;
struct ftrace_event_call *call; struct ftrace_event_call *call;
char buf[2]; char buf[2];
int set = 0; int set = 0;
@ -568,7 +568,7 @@ system_enable_read(struct file *filp, char __user *ubuf, size_t cnt,
if (!call->name || !call->class || !call->class->reg) if (!call->name || !call->class || !call->class->reg)
continue; continue;
if (system && strcmp(call->class->system, system) != 0) if (system && strcmp(call->class->system, system->name) != 0)
continue; continue;
/* /*
@ -598,7 +598,8 @@ static ssize_t
system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt, system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
loff_t *ppos) loff_t *ppos)
{ {
const char *system = filp->private_data; struct event_subsystem *system = filp->private_data;
const char *name = NULL;
unsigned long val; unsigned long val;
char buf[64]; char buf[64];
ssize_t ret; ssize_t ret;
@ -622,7 +623,14 @@ system_enable_write(struct file *filp, const char __user *ubuf, size_t cnt,
if (val != 0 && val != 1) if (val != 0 && val != 1)
return -EINVAL; return -EINVAL;
ret = __ftrace_set_clr_event(NULL, system, NULL, val); /*
* Opening of "enable" adds a ref count to system,
* so the name is safe to use.
*/
if (system)
name = system->name;
ret = __ftrace_set_clr_event(NULL, name, NULL, val);
if (ret) if (ret)
goto out; goto out;
@ -862,6 +870,9 @@ static int subsystem_open(struct inode *inode, struct file *filp)
struct event_subsystem *system = NULL; struct event_subsystem *system = NULL;
int ret; int ret;
if (!inode->i_private)
goto skip_search;
/* Make sure the system still exists */ /* Make sure the system still exists */
mutex_lock(&event_mutex); mutex_lock(&event_mutex);
list_for_each_entry(system, &event_subsystems, list) { list_for_each_entry(system, &event_subsystems, list) {
@ -880,8 +891,9 @@ static int subsystem_open(struct inode *inode, struct file *filp)
if (system != inode->i_private) if (system != inode->i_private)
return -ENODEV; return -ENODEV;
skip_search:
ret = tracing_open_generic(inode, filp); ret = tracing_open_generic(inode, filp);
if (ret < 0) if (ret < 0 && system)
put_system(system); put_system(system);
return ret; return ret;
@ -891,7 +903,8 @@ static int subsystem_release(struct inode *inode, struct file *file)
{ {
struct event_subsystem *system = inode->i_private; struct event_subsystem *system = inode->i_private;
put_system(system); if (system)
put_system(system);
return 0; return 0;
} }
@ -1041,10 +1054,11 @@ static const struct file_operations ftrace_subsystem_filter_fops = {
}; };
static const struct file_operations ftrace_system_enable_fops = { static const struct file_operations ftrace_system_enable_fops = {
.open = tracing_open_generic, .open = subsystem_open,
.read = system_enable_read, .read = system_enable_read,
.write = system_enable_write, .write = system_enable_write,
.llseek = default_llseek, .llseek = default_llseek,
.release = subsystem_release,
}; };
static const struct file_operations ftrace_show_header_fops = { static const struct file_operations ftrace_show_header_fops = {
@ -1133,8 +1147,7 @@ event_subsystem_dir(const char *name, struct dentry *d_events)
"'%s/filter' entry\n", name); "'%s/filter' entry\n", name);
} }
trace_create_file("enable", 0644, system->entry, trace_create_file("enable", 0644, system->entry, system,
(void *)system->name,
&ftrace_system_enable_fops); &ftrace_system_enable_fops);
return system->entry; return system->entry;