[PATCH 0/6] tracing: Fix removing instances while reading/writing to their files

From: Steven Rostedt
Date: Wed Sep 06 2023 - 22:48:01 EST



It appears that the dynamic code of eventfs has caused a race window
to open up a bit more and showed that several files were not protected
by the trace array ref count. This means that a task could open one
of the files in an instance, remove the instance, and still be able to
read or write to that file. That access will then cause a "use-after-free"
bug.

Close those holes!

Also, fix a left over unused variable in the eventfs dput fix.

Steven Rostedt (Google) (6):
tracefs/eventfs: Use dput to free the toplevel events directory
tracing: Increase trace array ref count on enable and filter files
tracing: Have tracing_max_latency inc the trace array ref count
tracing: Have current_trace inc the trace array ref count
tracing: Have option files inc the trace array ref count
tracing: Have event inject files inc the trace array ref count

----
fs/tracefs/event_inode.c | 17 +++++++---
fs/tracefs/inode.c | 2 +-
fs/tracefs/internal.h | 5 +--
kernel/trace/trace.c | 68 ++++++++++++++++++++++++++++++++++----
kernel/trace/trace.h | 2 ++
kernel/trace/trace_events.c | 6 ++--
kernel/trace/trace_events_inject.c | 3 +-
7 files changed, 85 insertions(+), 18 deletions(-)