Re: [PATCH] tracing: Have show_event_filters/triggers files take trace array ref

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Use-after-free in trace_options_core_read and trace_options_core_write due to missing trace_array reference.
--

commit ea5806b528a93a9450975f8b2320a019a3fbc9c7
Author: Steven Rostedt [off-list ref]

tracing: Have show_event_filters/triggers files take trace array ref

This commit fixes a use-after-free issue when reading show_event_filters or
show_event_triggers files by ensuring their open operations take a reference
on the trace array. This prevents the trace array from being freed via rmdir
while a task is still reading the files.

Closes: https://lore.kernel.org/all/CA+0ovCjerKZJLwXScM9bF2ga2rLi4_XOpUfK41NDbENpeu98jA@mail.gmail.com/ (local)

[ ... ]

[Severity: Critical]
This isn't a bug introduced by this patch, but since we are fixing missing
trace array references, does a similar use-after-free exist for the trace
options files?

Looking at trace_options_core_fops in kernel/trace/trace.c, it registers
tracing_open_generic() as the open handler. That function passes NULL
to tracing_check_open_get_tr(), bypassing the trace_array_get() call:

kernel/trace/trace.c:tracing_open_generic() {
	int ret;

	ret = tracing_check_open_get_tr(NULL);
	if (ret)
		return ret;

	filp->private_data = inode->i_private;
	return 0;
}

Because no reference is taken on the trace array, could a user remove the
trace instance via rmdir while holding the options file open, and then
trigger a use-after-free when reading or writing?

For example, trace_options_core_read() retrieves the freed trace_array
via get_tr_index() and immediately dereferences it:

kernel/trace/trace.c:trace_options_core_read() {
	...
	get_tr_index(tr_index, &tr, &index);

	if (tr->trace_flags & (1ULL << index))
	...
}

+	if (ret)
+		return ret;
+
+	ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+	if (ret < 0)
+		trace_array_put(tr);
+	return ret;
 }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828094153.17b95037@gandalf.local.home?part=1