Skip to contentSkip to conversation

tracing: A couple of fixes with tracefs

GIT PULL New Steven Rostedt 1 participant 3 messages Sep 25, 2016

Subsystems (2)
Stable branch Tracing
lore
Share & tools
lore

Steven Rostedt

author maintainer
#0 lore raw

Linus,

Al Viro has been looking at the tracefs code, and has pointed out some issues. This contains one fix by me and one by Al. I'm sure that he'll come up with more but for now I tested these patches and they don't appear to have any negative impact on tracing.

Please pull the latest trace-v4.8-rc7 tree, which can be found at:

git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v4.8-rc7

Tag SHA1: 7a41afe1fd2b8a81f979c6e00533b68b07af2519 Head SHA1: 1ae2293dd6d2f5c823cf97e60b70d03631cd622f

Al Viro (1):
fix memory leaks in tracing_buffers_splice_read()

Steven Rostedt (Red Hat) (1):
tracing: Move mutex to protect against resetting of seq data

----

 kernel/trace/trace.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)
author maintainer
#1 lore raw

PATCH 1/2 tracing: Move mutex to protect against resetting of seq data

From: "Steven Rostedt (Red Hat)" <[email protected]>

The iter->seq can be reset outside the protection of the mutex. So can reading of user data. Move the mutex up to the beginning of the function.

Fixes d7350c3f45694 ("tracing/core: make the read callbacks reentrants")
Cc [email protected] # 2.6.30+
Reported-by Al Viro <[email protected]>
Signed-off-by Steven Rostedt <[email protected]>
---
 kernel/trace/trace.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)
kernel/trace/trace.c +8 -7
index 8a4bd6b68a0b..8fb4847b0450 100644
@@ -4890,19 +4890,20 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
 	struct trace_iterator *iter = filp->private_data;
 	ssize_t sret;
 
-	/* return any leftover data */
-	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
-	if (sret != -EBUSY)
-		return sret;
-
-	trace_seq_init(&iter->seq);
-
 	/*
 	 * Avoid more than one consumer on a single file descriptor
 	 * This is just a matter of traces coherency, the ring buffer itself
 	 * is protected.
 	 */
 	mutex_lock(&iter->mutex);
+
+	/* return any leftover data */
+	sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
+	if (sret != -EBUSY)
+		goto out;
+
+	trace_seq_init(&iter->seq);
+
 	if (iter->trace->read) {
 		sret = iter->trace->read(iter, filp, ubuf, cnt, ppos);
 		if (sret)
Signature · 1 line
2.8.1
author maintainer
#2 lore raw

PATCH 2/2 fix memory leaks in tracing_buffers_splice_read()

In reply to Steven Rostedt

From: Al Viro <[email protected]>

Cc [email protected]
Signed-off-by Al Viro <[email protected]>
---
 kernel/trace/trace.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)
kernel/trace/trace.c +8 -6
index 8fb4847b0450..77eeab2776ef 100644
@@ -5930,9 +5930,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
 		return -EBUSY;
 #endif
 
-	if (splice_grow_spd(pipe, &spd))
-		return -ENOMEM;
-
 	if (*ppos & (PAGE_SIZE - 1))
 		return -EINVAL;
 

@@ -5942,6 +5939,9 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
 		len &= PAGE_MASK;
 	}
 
+	if (splice_grow_spd(pipe, &spd))
+		return -ENOMEM;
+
  again:
 	trace_access_lock(iter->cpu_file);
 	entries = ring_buffer_entries_cpu(iter->trace_buffer->buffer, iter->cpu_file);

@@ -5999,19 +5999,21 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos,
 	/* did we read anything? */
 	if (!spd.nr_pages) {
 		if (ret)
-			return ret;
+			goto out;
 
+		ret = -EAGAIN;
 		if ((file->f_flags & O_NONBLOCK) || (flags & SPLICE_F_NONBLOCK))
-			return -EAGAIN;
+			goto out;
 
 		ret = wait_on_pipe(iter, true);
 		if (ret)
-			return ret;
+			goto out;
 
 		goto again;
 	}
 
 	ret = splice_to_pipe(pipe, &spd);
+out:
 	splice_shrink_spd(&spd);
 
 	return ret;
Signature · 1 line
2.8.1