Commit f0a0da1f authored by Petr Pavlu's avatar Petr Pavlu Committed by Steven Rostedt (Google)
Browse files

tracing: Fix checking of freed trace_event_file for hist files 

The event_hist_open() and event_hist_poll() functions currently retrieve
a trace_event_file pointer from a file struct by invoking
event_file_data(), which simply returns file->f_inode->i_private. The
functions then check if the pointer is NULL to determine whether the event
is still valid. This approach is flawed because i_private is assigned when
an eventfs inode is allocated and remains set throughout its lifetime.
Instead, the code should call event_file_file(), which checks for
EVENT_FILE_FL_FREED. Using the incorrect access function may result in the
code potentially opening a hist file for an event that is being removed or
becoming stuck while polling on this file.

Correct the access method to event_file_file() in both functions.

Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Link: https://patch.msgid.link/20260219162737.314231-2-petr.pavlu@suse.com


Fixes: 1bd13edb ("tracing/hist: Add poll(POLLIN) support on hist file")
Signed-off-by: default avatarPetr Pavlu <petr.pavlu@suse.com>
Acked-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent f4ff9f64

kernel/trace/trace_events_hist.c

+2 −2
Original line number Diff line number Diff line
@@ -5784,7 +5784,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai 


	guard(mutex)(&event_mutex);



	event_file = event_file_data(file);

	event_file = event_file_file(file);

	if (!event_file)

		return EPOLLERR;
@@ -5822,7 +5822,7 @@ static int event_hist_open(struct inode *inode, struct file *file) 


	guard(mutex)(&event_mutex);



	event_file = event_file_data(file);

	event_file = event_file_file(file);

	if (!event_file) {

		ret = -ENODEV;

		goto err;