linux-kernel - Re: [PATCH] tracing: Correct the refcount for hist/hist_debug file if single

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1921659c-9bf7-4fd5-97e7-512da777461f@huaweicloud.com>
Date: Fri, 14 Mar 2025 08:57:22 +0800
From: Tengda Wu <wutengda@...weicloud.com>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Masami Hiramatsu <mhiramat@...nel.org>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Zheng Yejian <zhengyejian1@...wei.com>, linux-trace-kernel@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] tracing: Correct the refcount for hist/hist_debug file if
 single_open() fails

Hi Steven,

On 2025/3/13 22:44, Steven Rostedt wrote:
> On Thu, 13 Mar 2025 10:37:19 +0000
> Tengda Wu <wutengda@...weicloud.com> wrote:
> 
>> The function event_{hist,hist_debug}_open() maintains the refcount of
>> 'file->tr' and 'file' through tracing_open_file_tr(), but it does not
>> roll back these counts when the subsequent single_open() call fails,
>> leading to a refcount leak.
>>
>> A very obvious case is that if the hist/hist_debug file belongs to a
>> certain instance, the failure of single_open() will prevent the deletion
>> of that instance, as it relies on the condition 'tr->ref == 1' within
>> __remove_instance().
>>
>> Fix this by calling tracing_release_file_tr() to correct the refcount
>> when single_open() fails.
>>
>> Fixes: 1cc111b9cddc ("tracing: Fix uaf issue when open the hist or hist_debug file")
>> Signed-off-by: Tengda Wu <wutengda@...weicloud.com>
>> Cc: stable@...r.kernel.org # v6.7+
>> ---
>>  kernel/trace/trace_events_hist.c | 9 +++++++--
>>  1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
>> index ad7419e24055..900b06fa8505 100644
>> --- a/kernel/trace/trace_events_hist.c
>> +++ b/kernel/trace/trace_events_hist.c
>> @@ -5702,8 +5702,10 @@ static int event_hist_open(struct inode *inode, struct file *file)
>>  	/* Clear private_data to avoid warning in single_open() */
>>  	file->private_data = NULL;
>>  	ret = single_open(file, hist_show, hist_file);
>> -	if (ret)
>> +	if (ret) {
>>  		kfree(hist_file);
>> +		tracing_release_file_tr(inode, file);
>> +	}
> 
> Hmm, this function has a couple more error path exits after taking the
> ref count. If this is to be fixed, let's fix it completely. Each of
> those error paths need to call tracing_release_file_tr().
> 
> -- Steve

Oops, I got it. The v2 is coming soon. Thanks a lot.

-- Tengda

> 
> 
>>  
>>  	return ret;
>>  }
>> @@ -5979,7 +5981,10 @@ static int event_hist_debug_open(struct inode *inode, struct file *file)
>>  
>>  	/* Clear private_data to avoid warning in single_open() */
>>  	file->private_data = NULL;
>> -	return single_open(file, hist_debug_show, file);
>> +	ret = single_open(file, hist_debug_show, file);
>> +	if (ret)
>> +		tracing_release_file_tr(inode, file);
>> +	return ret;
>>  }
>>  
>>  const struct file_operations event_hist_debug_fops = {