Skip to content

Commit

Permalink
tracing: Fix fields of struct trace_iterator that are zeroed by mistake
Browse files Browse the repository at this point in the history
tracing_read_pipe zeros all fields bellow "seq". The declaration contains
a comment about that, but it doesn't help.

The first field is "snapshot", it's true when current open file is
snapshot. Looks obvious, that it should not be zeroed.

The second field is "started". It was converted from cpumask_t to
cpumask_var_t (v2.6.28-4983-g4462344), in other words it was
converted from cpumask to pointer on cpumask.

Currently the reference on "started" memory is lost after the first read
from tracing_read_pipe and a proper object will never be freed.

The "started" is never dereferenced for trace_pipe, because trace_pipe
can't have the TRACE_FILE_ANNOTATE options.

Link: http://lkml.kernel.org/r/[email protected]

Cc: [email protected] # 2.6.30
Signed-off-by: Andrew Vagin <[email protected]>
Signed-off-by: Steven Rostedt <[email protected]>
  • Loading branch information
avagin authored and rostedt committed Aug 3, 2013
1 parent c6c2401 commit ed5467d
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 4 deletions.
10 changes: 6 additions & 4 deletions include/linux/ftrace_event.h
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,11 @@ struct trace_iterator {
/* trace_seq for __print_flags() and __print_symbolic() etc. */
struct trace_seq tmp_seq;

cpumask_var_t started;

/* it's true when current open file is snapshot */
bool snapshot;

/* The below is zeroed out in pipe_read */
struct trace_seq seq;
struct trace_entry *ent;
Expand All @@ -90,10 +95,7 @@ struct trace_iterator {
loff_t pos;
long idx;

cpumask_var_t started;

/* it's true when current open file is snapshot */
bool snapshot;
/* All new field here will be zeroed out in pipe_read */
};

enum trace_iter_flags {
Expand Down
1 change: 1 addition & 0 deletions kernel/trace/trace.c
Original file line number Diff line number Diff line change
Expand Up @@ -4151,6 +4151,7 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
memset(&iter->seq, 0,
sizeof(struct trace_iterator) -
offsetof(struct trace_iterator, seq));
cpumask_clear(iter->started);
iter->pos = -1;

trace_event_read_lock();
Expand Down

0 comments on commit ed5467d

Please sign in to comment.