Re: [PATCH v3 7/9] tracing/osnoise: Split out per-cpu variable resets
flat view
From: sashiko-bot@kernel.org
Date: 2026-10-14 02:39:15
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] tracing/osnoise: unconditional osn_reset_cpu corrupts active tracer state -- commit e7bd03b79c8b047561cc86479c9cbb434768ea94 Author: Crystal Wood [off-list ref] tracing/osnoise: Split out per-cpu variable resets Reset per-cpu state every time we stop a kthread or detach an fd, rather than assume everything gets cleaned up properly, and avoiding the need to explicitly zero individual fields.
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c index 22263e08b968b..d799c400ed9b7 100644 --- a/kernel/trace/trace_osnoise.c +++ b/kernel/trace/trace_osnoise.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -2695,13 +2691,12 @@ timerlat_fd_read(struct file *file, char __user *ubuf, size_t count, static int timerlat_fd_release(struct inode *inode, struct file *file) { struct fd_data *fdd = file->private_data; - struct osnoise_variables *osn_var; - - osn_var = cpu_osn_var(fdd->cpu); + struct osnoise_variables *osn_var = cpu_osn_var(fdd->cpu); mutex_lock(&osn_var->lock); if (fdd == osn_var->fdd) timerlat_fd_detach(fdd); + osn_reset_cpu(fdd->cpu);
[Severity: High] Does this unconditionally call osn_reset_cpu() even when the file descriptor was already detached? If tracing is stopped and the active file descriptor is detached, userspace can start a new tracing session. This sets osn_var->fdd to a new fdd and arms a new hrtimer on the CPU. If userspace subsequently closes the old, detached file descriptor, timerlat_fd_release() executes, skips timerlat_fd_detach(), and unconditionally calls osn_reset_cpu(). Could this trigger a WARN_ON(osn->fdd) and zero out the tlat->zero and osn->zero structs of the newly active session, corrupting its queued hrtimer and potentially causing memory corruption or a kernel panic?
mutex_unlock(&osn_var->lock); kfree(fdd);
-- Sashiko AI review · https://sashiko.dev/#/patchset/20261014022640.695786-1-crwood@redhat.com?part=7