Re: [PATCH 1/5] tracing: Fix checking of freed trace_event_file for hist files
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Date: 2026-02-10 15:59:19
Also in:
lkml
On Tue, 10 Feb 2026 12:28:16 +0100 Petr Pavlu [off-list ref] wrote:
The event_hist_open() and event_hist_poll() functions currently retrieve a trace_event_file pointer from a file struct by invoking event_file_data(), which simply returns file->f_inode->i_private. The functions then check if the pointer is NULL to determine whether the event is still valid. This approach is flawed because i_private is assigned when an eventfs inode is allocated and remains set throughout its lifetime. Instead, the code should call event_file_file(), which checks for EVENT_FILE_FL_FREED. Using the incorrect access function may result in the code potentially opening a hist file for an event that is being removed or becoming stuck while polling on this file. A related issue is that although event_hist_poll() attempts to verify whether an event file is being removed, this check may not occur or could be unnecessarily delayed. This happens because hist_poll_wakeup() is currently invoked only from event_hist_trigger() when a hist command is triggered. If the event file is being removed, no associated hist command will be triggered and a waiter will be woken up only after an unrelated hist command is triggered. Fix these issues by changing the access method to event_file_file() and adding a call to hist_poll_wakeup() in remove_event_file_dir() after setting the EVENT_FILE_FL_FREED flag. This ensures that a task polling on a hist file is woken up and receives EPOLLERR.
Thanks for fixing! Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
quoted hunk ↗ jump to hunk
Fixes: 1bd13edbbed6 ("tracing/hist: Add poll(POLLIN) support on hist file") Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> --- kernel/trace/trace_events.c | 3 +++ kernel/trace/trace_events_hist.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-)diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 137b4d9bb116..e8ed6ba155cf 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c@@ -1295,6 +1295,9 @@ static void remove_event_file_dir(struct trace_event_file *file) free_event_filter(file->filter); file->flags |= EVENT_FILE_FL_FREED; event_file_put(file); + + /* Wake up hist poll waiters to notice the EVENT_FILE_FL_FREED flag. */ + hist_poll_wakeup(); } /*diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index c97bb2fda5c0..744c2aa3d668 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c@@ -5778,7 +5778,7 @@ static __poll_t event_hist_poll(struct file *file, struct poll_table_struct *wai guard(mutex)(&event_mutex); - event_file = event_file_data(file); + event_file = event_file_file(file); if (!event_file) return EPOLLERR;@@ -5816,7 +5816,7 @@ static int event_hist_open(struct inode *inode, struct file *file) guard(mutex)(&event_mutex); - event_file = event_file_data(file); + event_file = event_file_file(file); if (!event_file) { ret = -ENODEV; goto err;-- 2.52.0
-- Masami Hiramatsu (Google) [off-list ref]