History

tracing: Fix fields of struct trace_iterator that are zeroed by mistake

tracing_read_pipe zeros all fields bellow "seq". The declaration contains a comment about that, but it doesn't help. The first field is "snapshot", it's true when current open file is snapshot. Looks obvious, that it should not be zeroed. The second field is "started". It was converted from cpumask_t to cpumask_var_t (v2.6.28-4983-g4462344), in other words it was converted from cpumask to pointer on cpumask. Currently the reference on "started" memory is lost after the first read from tracing_read_pipe and a proper object will never be freed. The "started" is never dereferenced for trace_pipe, because trace_pipe can't have the TRACE_FILE_ANNOTATE options. Link: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org

Andrew Vagin committed 13 years ago

Commit ed5467d1 parent c6c24012 files · +7 −4Browse files

Unified · Split

2 files
  1. include/linux/ftrace_event.h +6 −4
  2. kernel/trace/trace.c +1 −0
include/linux/ftrace_event.h+6−4
@@ -78,6 +78,11 @@ struct trace_iterator { · 77 unmodified lines
78 /* trace_seq for __print_flags() and __print_symbolic() etc. */78 /* trace_seq for __print_flags() and __print_symbolic() etc. */
79 struct trace_seq tmp_seq;79 struct trace_seq tmp_seq;
80 80
81 cpumask_var_t started;
82
83 /* it's true when current open file is snapshot */
84 bool snapshot;
85
81 /* The below is zeroed out in pipe_read */86 /* The below is zeroed out in pipe_read */
82 struct trace_seq seq;87 struct trace_seq seq;
83 struct trace_entry *ent;88 struct trace_entry *ent;
@@ -90,10 +95,7 @@ struct trace_iterator { · 6 unmodified lines
90 loff_t pos;95 loff_t pos;
91 long idx;96 long idx;
92 97
93 cpumask_var_t started;98 /* All new field here will be zeroed out in pipe_read */
94
95 /* it's true when current open file is snapshot */
96 bool snapshot;
97};99};
98 100
99enum trace_iter_flags {101enum trace_iter_flags {
kernel/trace/trace.c+1−0
@@ -4151,6 +4151,7 @@ waitagain: · 4150 unmodified lines
4151 memset(&iter->seq, 0,4151 memset(&iter->seq, 0,
4152 sizeof(struct trace_iterator) -4152 sizeof(struct trace_iterator) -
4153 offsetof(struct trace_iterator, seq));4153 offsetof(struct trace_iterator, seq));
4154 cpumask_clear(iter->started);
4154 iter->pos = -1;4155 iter->pos = -1;
4155 4156
4156 trace_event_read_lock();4157 trace_event_read_lock();