aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/trace
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2013-07-23 11:25:54 -0400
committerSteven Rostedt <rostedt@rostedt.homelinux.com>2013-07-24 11:22:13 -0400
commit649e9c70da6bfbeb563193a35d3424a5aa7c0d38 (patch)
tree3a9a5ab0fae2b98483ff55f0a8727987a4a8b780 /kernel/trace
parente70e78e3c83b536730e31231dd9b979768d8df3c (diff)
tracing: Introduce trace_create_cpu_file() and tracing_get_cpu()
Every "file_operations" used by tracing_init_debugfs_percpu is buggy. f_op->open/etc does: 1. struct trace_cpu *tc = inode->i_private; struct trace_array *tr = tc->tr; 2. trace_array_get(tr) or fail; 3. do_something(tc); But tc (and tr) can be already freed before trace_array_get() is called. And it doesn't matter whether this file is per-cpu or it was created by init_tracer_debugfs(), free_percpu() or kfree() are equally bad. Note that even 1. is not safe, the freed memory can be unmapped. But even if it was safe trace_array_get() can wrongly succeed if we also race with the next new_instance_create() which can re-allocate the same tr, or tc was overwritten and ->tr points to the valid tr. In this case 3. uses the freed/reused memory. Add the new trivial helper, trace_create_cpu_file() which simply calls trace_create_file() and encodes "cpu" in "struct inode". Another helper, tracing_get_cpu() will be used to read cpu_nr-or-RING_BUFFER_ALL_CPUS. The patch abuses ->i_cdev to encode the number, it is never used unless the file is S_ISCHR(). But we could use something else, say, i_bytes or even ->d_fsdata. In any case this hack is hidden inside these 2 helpers, it would be trivial to change them if needed. This patch only changes tracing_init_debugfs_percpu() to use the new trace_create_cpu_file(), the next patches will change file_operations. Note: tracing_get_cpu(inode) is always safe but you can't trust the result unless trace_array_get() was called, without trace_types_lock which acts as a barrier it can wrongly return RING_BUFFER_ALL_CPUS. Link: http://lkml.kernel.org/r/20130723152554.GA23710@redhat.com Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace')
-rw-r--r--kernel/trace/trace.c50
1 files changed, 36 insertions, 14 deletions
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 3f2477713aca..cfff63c2148a 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2843,6 +2843,17 @@ static int s_show(struct seq_file *m, void *v)
2843 return 0; 2843 return 0;
2844} 2844}
2845 2845
2846/*
2847 * Should be used after trace_array_get(), trace_types_lock
2848 * ensures that i_cdev was already initialized.
2849 */
2850static inline int tracing_get_cpu(struct inode *inode)
2851{
2852 if (inode->i_cdev) /* See trace_create_cpu_file() */
2853 return (long)inode->i_cdev - 1;
2854 return RING_BUFFER_ALL_CPUS;
2855}
2856
2846static const struct seq_operations tracer_seq_ops = { 2857static const struct seq_operations tracer_seq_ops = {
2847 .start = s_start, 2858 .start = s_start,
2848 .next = s_next, 2859 .next = s_next,
@@ -5529,6 +5540,17 @@ static struct dentry *tracing_dentry_percpu(struct trace_array *tr, int cpu)
5529 return tr->percpu_dir; 5540 return tr->percpu_dir;
5530} 5541}
5531 5542
5543static struct dentry *
5544trace_create_cpu_file(const char *name, umode_t mode, struct dentry *parent,
5545 void *data, long cpu, const struct file_operations *fops)
5546{
5547 struct dentry *ret = trace_create_file(name, mode, parent, data, fops);
5548
5549 if (ret) /* See tracing_get_cpu() */
5550 ret->d_inode->i_cdev = (void *)(cpu + 1);
5551 return ret;
5552}
5553
5532static void 5554static void
5533tracing_init_debugfs_percpu(struct trace_array *tr, long cpu) 5555tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
5534{ 5556{
@@ -5548,28 +5570,28 @@ tracing_init_debugfs_percpu(struct trace_array *tr, long cpu)
5548 } 5570 }
5549 5571
5550 /* per cpu trace_pipe */ 5572 /* per cpu trace_pipe */
5551 trace_create_file("trace_pipe", 0444, d_cpu, 5573 trace_create_cpu_file("trace_pipe", 0444, d_cpu,
5552 (void *)&data->trace_cpu, &tracing_pipe_fops); 5574 &data->trace_cpu, cpu, &tracing_pipe_fops);
5553 5575
5554 /* per cpu trace */ 5576 /* per cpu trace */
5555 trace_create_file("trace", 0644, d_cpu, 5577 trace_create_cpu_file("trace", 0644, d_cpu,
5556 (void *)&data->trace_cpu, &tracing_fops); 5578 &data->trace_cpu, cpu, &tracing_fops);
5557 5579
5558 trace_create_file("trace_pipe_raw", 0444, d_cpu, 5580 trace_create_cpu_file("trace_pipe_raw", 0444, d_cpu,
5559 (void *)&data->trace_cpu, &tracing_buffers_fops); 5581 &data->trace_cpu, cpu, &tracing_buffers_fops);
5560 5582
5561 trace_create_file("stats", 0444, d_cpu, 5583 trace_create_cpu_file("stats", 0444, d_cpu,
5562 (void *)&data->trace_cpu, &tracing_stats_fops); 5584 &data->trace_cpu, cpu, &tracing_stats_fops);
5563 5585
5564 trace_create_file("buffer_size_kb", 0444, d_cpu, 5586 trace_create_cpu_file("buffer_size_kb", 0444, d_cpu,
5565 (void *)&data->trace_cpu, &tracing_entries_fops); 5587 &data->trace_cpu, cpu, &tracing_entries_fops);
5566 5588
5567#ifdef CONFIG_TRACER_SNAPSHOT 5589#ifdef CONFIG_TRACER_SNAPSHOT
5568 trace_create_file("snapshot", 0644, d_cpu, 5590 trace_create_cpu_file("snapshot", 0644, d_cpu,
5569 (void *)&data->trace_cpu, &snapshot_fops); 5591 &data->trace_cpu, cpu, &snapshot_fops);
5570 5592
5571 trace_create_file("snapshot_raw", 0444, d_cpu, 5593 trace_create_cpu_file("snapshot_raw", 0444, d_cpu,
5572 (void *)&data->trace_cpu, &snapshot_raw_fops); 5594 &data->trace_cpu, cpu, &snapshot_raw_fops);
5573#endif 5595#endif
5574} 5596}
5575 5597