[PATCH v2 1/3] tracing/user_events: Serialize duplicate enabler lookup with event removal
flat view
COOLING8d
From: Jeff Barnes <hidden>
Date: 2026-10-06 16:47:33
Also in:
linux-kselftest, lkml
Subsystem:
the rest, tracing · Maintainers:
Linus Torvalds, Steven Rostedt, Masami Hiramatsu
user_event_enabler_exists() performs a plain traversal of the per-mm enabler list. Registration invokes it while holding the event group's reg_mutex, which serializes registration and unregister operations from that group. However, deferred fault cleanup can remove an enabler asynchronously while holding event_mutex without holding the group reg_mutex. The plain list traversal can therefore race with list_del_rcu() despite the registration mutex being held. Take event_mutex around user_event_enabler_exists() so the traversal is serialized with all enabler removal paths. Pass the group into current_user_event_enabler_exists() and assert that its reg_mutex is already held. This preserves the established lock order of group->reg_mutex followed by event_mutex. Signed-off-by: Jeff Barnes <redacted> --- kernel/trace/trace_events_user.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
index f658c3a77aa7..24983f68d075 100644
--- a/kernel/trace/trace_events_user.c
+++ b/kernel/trace/trace_events_user.c@@ -890,16 +890,21 @@ void user_event_mm_dup(struct task_struct *t, struct user_event_mm *old_mm) user_event_mm_destroy(mm); } -static bool current_user_event_enabler_exists(unsigned long uaddr, - unsigned char bit) +static bool +current_user_event_enabler_exists(struct user_event_group *group, + unsigned long uaddr, unsigned char bit) { struct user_event_mm *user_mm = current_user_event_mm(); bool exists; + lockdep_assert_held(&group->reg_mutex); + if (!user_mm) return false; + mutex_lock(&event_mutex); exists = user_event_enabler_exists(user_mm, uaddr, bit); + mutex_unlock(&event_mutex); user_event_mm_put(user_mm);
@@ -2510,7 +2515,8 @@ static long user_events_ioctl_reg(struct user_event_file_info *info, * for user processes that is far easier to debug if this is explicitly * an error upon registering. */ - if (current_user_event_enabler_exists((unsigned long)reg.enable_addr, + if (current_user_event_enabler_exists(info->group, + (unsigned long)reg.enable_addr, reg.enable_bit)) return -EADDRINUSE;
--
2.43.0