Commit 0b4ffbe4 authored by Tengda Wu's avatar Tengda Wu Committed by Steven Rostedt (Google)
Browse files

tracing: Correct the refcount if the hist/hist_debug file fails to open 

The function event_{hist,hist_debug}_open() maintains the refcount of
'file->tr' and 'file' through tracing_open_file_tr(). However, it does
not roll back these counts on subsequent failure paths, resulting in a
refcount leak.

A very obvious case is that if the hist/hist_debug file belongs to a
specific instance, the refcount leak will prevent the deletion of that
instance, as it relies on the condition 'tr->ref == 1' within
__remove_instance().

Fix this by calling tracing_release_file_tr() on all failure paths in
event_{hist,hist_debug}_open() to correct the refcount.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Zheng Yejian <zhengyejian1@huawei.com>
Link: https://lore.kernel.org/20250314065335.1202817-1-wutengda@huaweicloud.com


Fixes: 1cc111b9 ("tracing: Fix uaf issue when open the hist or hist_debug file")
Signed-off-by: default avatarTengda Wu <wutengda@huaweicloud.com>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 7eb17214

kernel/trace/trace_events_hist.c

+18 −6
Original line number Diff line number Diff line
@@ -5689,12 +5689,16 @@ static int event_hist_open(struct inode *inode, struct file *file) 
	guard(mutex)(&event_mutex);



	event_file = event_file_data(file);

	if (!event_file)

		return -ENODEV;

	if (!event_file) {

		ret = -ENODEV;

		goto err;

	}



	hist_file = kzalloc(sizeof(*hist_file), GFP_KERNEL);

	if (!hist_file)

		return -ENOMEM;

	if (!hist_file) {

		ret = -ENOMEM;

		goto err;

	}



	hist_file->file = file;

	hist_file->last_act = get_hist_hit_count(event_file);
@@ -5702,9 +5706,14 @@ static int event_hist_open(struct inode *inode, struct file *file) 
	/* Clear private_data to avoid warning in single_open() */

	file->private_data = NULL;

	ret = single_open(file, hist_show, hist_file);

	if (ret)

	if (ret) {

		kfree(hist_file);

		goto err;

	}



	return 0;

err:

	tracing_release_file_tr(inode, file);

	return ret;

}
@@ -5979,7 +5988,10 @@ static int event_hist_debug_open(struct inode *inode, struct file *file) 


	/* Clear private_data to avoid warning in single_open() */

	file->private_data = NULL;

	return single_open(file, hist_debug_show, file);

	ret = single_open(file, hist_debug_show, file);

	if (ret)

		tracing_release_file_tr(inode, file);

	return ret;

}



const struct file_operations event_hist_debug_fops = {