tracing_read_pipe zeros all fields bellow "seq". The declaration contains a comment about that, but it doesn't help. The first field is "snapshot", it's true when current open file is snapshot. Looks obvious, that it should not be zeroed. The second field is "started". It was converted from cpumask_t to cpumask_var_t (v2.6.28-4983-g4462344), in other words it was converted from cpumask to pointer on cpumask. Currently the reference on "started" memory is lost after the first read from tracing_read_pipe and a proper object will never be freed. The "started" is never dereferenced for trace_pipe, because trace_pipe can't have the TRACE_FILE_ANNOTATE options. Link: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org
Showing the changes to kernel (1 of 2 files). Show all
Unified · Split
| @@ -4151,6 +4151,7 @@ waitagain: · 4150 unmodified lines | |||
| 4151 | memset(&iter->seq, 0, | 4151 | memset(&iter->seq, 0, |
| 4152 | sizeof(struct trace_iterator) - | 4152 | sizeof(struct trace_iterator) - |
| 4153 | offsetof(struct trace_iterator, seq)); | 4153 | offsetof(struct trace_iterator, seq)); |
| 4154 | cpumask_clear(iter->started); | ||
| 4154 | iter->pos = -1; | 4155 | iter->pos = -1; |
| 4155 | 4156 | ||
| 4156 | trace_event_read_lock(); | 4157 | trace_event_read_lock(); |