[PATCH v4 11/11] tracing: change event_trigger_open to verify i_private != NULL

[Tom Zanussi]

Similar to the other fixes for the same thing elsewhere by Oleg
Nesterov...

event_trigger_regex_open() is racy, ftrace_event_file can be already
freed by rmdir or trace_remove_event_call().

Change event_trigger_open() to read and verify "file = i_private"
under event_mutex.

This also moves event_file_data() into trace.h so it can be used
outside of trace_events.c.

Signed-off-by: Tom Zanussi <tom.zanussi@xxxxxxxxxxxxxxx>
---
 kernel/trace/trace.h                | 4 ++++
 kernel/trace/trace_events.c         | 5 -----
 kernel/trace/trace_events_trigger.c | 7 ++++++-
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index c56a773..a6ef810 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1023,6 +1023,10 @@ extern int event_trace_del_tracer(struct trace_array *tr);
 extern struct ftrace_event_file *find_event_file(struct trace_array *tr,
 						 const char *system,
 						 const char *event);
+static inline void *event_file_data(struct file *filp)
+{
+	return ACCESS_ONCE(file_inode(filp)->i_private);
+}
 
 extern struct mutex event_mutex;
 extern struct list_head ftrace_events;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 6b4cb04..a444f65 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -427,11 +427,6 @@ static void remove_subsystem(struct ftrace_subsystem_dir *dir)
 	}
 }
 
-static void *event_file_data(struct file *filp)
-{
-	return ACCESS_ONCE(file_inode(filp)->i_private);
-}
-
 static void remove_event_file_dir(struct ftrace_event_file *file)
 {
 	struct dentry *dir = file->dir;
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 54112be..011bdfb 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -133,7 +133,12 @@ static int event_trigger_regex_open(struct inode *inode, struct file *file)
 
 	mutex_lock(&event_mutex);
 
-	iter->file = inode->i_private;
+	iter->file = event_file_data(file);
+	if (!iter->file) {
+		kfree(iter);
+		mutex_unlock(&event_mutex);
+		return -ENODEV;
+	}
 
 	if (file->f_mode & FMODE_READ) {
 		ret = seq_open(file, &event_triggers_seq_ops);
-- 
1.7.11.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/