linux-kernel - Re: [PATCH 1/5] tracing: Fix checking of freed trace_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260211005915.1516a1695be366571fd7d2c9@kernel.org>
Date: Wed, 11 Feb 2026 00:59:15 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Petr Pavlu <petr.pavlu@...e.com>
Cc: Steven Rostedt <rostedt@...dmis.org>, Mathieu Desnoyers
 <mathieu.desnoyers@...icios.com>, Tom Zanussi <zanussi@...nel.org>,
 linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org
Subject: Re: [PATCH 1/5] tracing: Fix checking of freed trace_event_file for
 hist files

On Tue, 10 Feb 2026 12:28:16 +0100
Petr Pavlu <petr.pavlu@...e.com> wrote:

> The event_hist_open() and event_hist_poll() functions currently retrieve
> a trace_event_file pointer from a file struct by invoking
> event_file_data(), which simply returns file->f_inode->i_private. The
> functions then check if the pointer is NULL to determine whether the event
> is still valid. This approach is flawed because i_private is assigned when
> an eventfs inode is allocated and remains set throughout its lifetime.
> Instead, the code should call event_file_file(), which checks for
> EVENT_FILE_FL_FREED. Using the incorrect access function may result in the
> code potentially opening a hist file for an event that is being removed or
> becoming stuck while polling on this file.
> 
> A related issue is that although event_hist_poll() attempts to verify
> whether an event file is being removed, this check may not occur or could
> be unnecessarily delayed. This happens because hist_poll_wakeup() is
> currently invoked only from event_hist_trigger() when a hist command is
> triggered. If the event file is being removed, no associated hist command
> will be triggered and a waiter will be woken up only after an unrelated
> hist command is triggered.
> 
> Fix these issues by changing the access method to event_file_file() and
> adding a call to hist_poll_wakeup() in remove_event_file_dir() after
> setting the EVENT_FILE_FL_FREED flag. This ensures that a task polling on
> a hist file is woken up and receives EPOLLERR.
> 

Thanks for fixing!

Acked-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>


> Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file")
> Signed-off-by: Petr Pavlu <petr.pavlu@...e.com>
> ---
>  kernel/trace/trace_events.c      | 3 +++
>  kernel/trace/trace_events_hist.c | 4 ++--
>  2 files changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> index 137b4d9bb116..e8ed6ba155cf 100644
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file)
>  	free_event_filter(file->filter);
>  	file->flags |= EVENT_FILE_FL_FREED;
>  	event_file_put(file);
> +
> +	/* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */
> +	hist_poll_wakeup();
>  }
>  
>  /*
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index c97bb2fda5c0..744c2aa3d668 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai
>  
>  	guard(mutex)(&event_mutex);
>  
> -	event_file = event_file_data(file);
> +	event_file = event_file_file(file);
>  	if (!event_file)
>  		return EPOLLERR;
>  
> @@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file)
>  
>  	guard(mutex)(&event_mutex);
>  
> -	event_file = event_file_data(file);
> +	event_file = event_file_file(file);
>  	if (!event_file) {
>  		ret = -ENODEV;
>  		goto err;
> -- 
> 2.52.0
> 


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>