[ 3.5.y.z extended stable ] Patch "tracing: Protect tracer flags with trace_types_lock" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    tracing: Protect tracer flags with trace_types_lock

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From e7542376f91073846ca59b0908e3fe5b77239a15 Mon Sep 17 00:00:00 2001
From: Lingzhu Xiang <lxiang at redhat.com>
Date: Thu, 28 Mar 2013 12:26:03 +0800
Subject: [PATCH] tracing: Protect tracer flags with trace_types_lock

commit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.

Backported for 3.4, 3.0-stable. Moved return to after unlock.

From: "Steven Rostedt (Red Hat)" <rostedt at goodmis.org>

Seems that the tracer flags have never been protected from
synchronous writes. Luckily, admins don't usually modify the
tracing flags via two different tasks. But if scripts were to
be used to modify them, then they could get corrupted.

Move the trace_types_lock that protects against tracers changing
to also protect the flags being set.

Cc: stable at vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
Signed-off-by: Lingzhu Xiang <lxiang at redhat.com>
Reviewed-by: CAI Qian <caiqian at redhat.com>
Signed-off-by: Luis Henriques<luis.henriques at canonical.com>
---
 kernel/trace/trace.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 199f77b..b354405 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2791,7 +2791,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
 	char buf[64];
 	char *cmp;
 	int neg = 0;
-	int ret;
+	int ret = 0;
 	int i;

 	if (cnt >= sizeof(buf))
@@ -2808,6 +2808,8 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
 		cmp += 2;
 	}

+	mutex_lock(&trace_types_lock);
+
 	for (i = 0; trace_options[i]; i++) {
 		if (strcmp(cmp, trace_options[i]) == 0) {
 			set_tracer_flags(1 << i, !neg);
@@ -2816,13 +2818,13 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
 	}

 	/* If no option could be set, test the specific tracer options */
-	if (!trace_options[i]) {
-		mutex_lock(&trace_types_lock);
+	if (!trace_options[i])
 		ret = set_tracer_option(current_trace, cmp, neg);
-		mutex_unlock(&trace_types_lock);
-		if (ret)
-			return ret;
-	}
+
+	mutex_unlock(&trace_types_lock);
+
+	if (ret)
+		return ret;

 	*ppos += cnt;

@@ -4601,7 +4603,10 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,

 	if (val != 0 && val != 1)
 		return -EINVAL;
+
+	mutex_lock(&trace_types_lock);
 	set_tracer_flags(1 << index, val);
+	mutex_unlock(&trace_types_lock);

 	*ppos += cnt;

--
1.8.1.2