[ 3.5.y.z extended stable ] Patch "tracing: Fix fields of struct trace_iterator that are zeroed" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    tracing: Fix fields of struct trace_iterator that are zeroed

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From b8ec47a75f413721bebb4b9852557bff0d1ab7db Mon Sep 17 00:00:00 2001
From: Andrew Vagin <avagin at openvz.org>
Date: Fri, 2 Aug 2013 21:16:43 +0400
Subject: [PATCH] tracing: Fix fields of struct trace_iterator that are zeroed
 by mistake

commit ed5467da0e369e65b247b99eb6403cb79172bcda upstream.

tracing_read_pipe zeros all fields bellow "seq". The declaration contains
a comment about that, but it doesn't help.

The first field is "snapshot", it's true when current open file is
snapshot. Looks obvious, that it should not be zeroed.

The second field is "started". It was converted from cpumask_t to
cpumask_var_t (v2.6.28-4983-g4462344), in other words it was
converted from cpumask to pointer on cpumask.

Currently the reference on "started" memory is lost after the first read
from tracing_read_pipe and a proper object will never be freed.

The "started" is never dereferenced for trace_pipe, because trace_pipe
can't have the TRACE_FILE_ANNOTATE options.

Link: http://lkml.kernel.org/r/1375463803-3085183-1-git-send-email-avagin@openvz.org

Signed-off-by: Andrew Vagin <avagin at openvz.org>
Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
[ luis: backported to 3.5:
  - dropped the 'snapshot' field as it is not present in 3.5 kernel ]
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 include/linux/ftrace_event.h | 4 +++-
 kernel/trace/trace.c         | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
index 176a939..16cad53 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
@@ -71,6 +71,8 @@ struct trace_iterator {
 	/* trace_seq for __print_flags() and __print_symbolic() etc. */
 	struct trace_seq	tmp_seq;

+	cpumask_var_t		started;
+
 	/* The below is zeroed out in pipe_read */
 	struct trace_seq	seq;
 	struct trace_entry	*ent;
@@ -83,7 +85,7 @@ struct trace_iterator {
 	loff_t			pos;
 	long			idx;

-	cpumask_var_t		started;
+	/* All new field here will be zeroed out in pipe_read */
 };


diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8aba3f9..09739c6 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3526,6 +3526,7 @@ waitagain:
 	memset(&iter->seq, 0,
 	       sizeof(struct trace_iterator) -
 	       offsetof(struct trace_iterator, seq));
+	cpumask_clear(iter->started);
 	iter->pos = -1;

 	trace_event_read_lock();
--
1.8.3.2