hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBKJZ ------------------ When the user reads event from mfs device, it will release the event object in the end. But the tracepoint outputs the message info whose space belongs to event object. And this cause the UAF problem on event object. Fixes: 18a8df2ba547 ("mfs: Add tracepoint for MFS") Signed-off-by: Hongbo Li <lihongbo22@huawei.com> --- fs/mfs/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/mfs/dev.c b/fs/mfs/dev.c index 902f73b1c25c..896fb6550eb5 100644 --- a/fs/mfs/dev.c +++ b/fs/mfs/dev.c @@ -106,8 +106,8 @@ static ssize_t mfs_dev_read(struct file *file, char __user *buf, xas_store(&xas, NULL); xas_unlock(&xas); out: - put_mfs_event(event); trace_mfs_dev_read(file, msg->opcode, msg->id, msg->fd); + put_mfs_event(event); return ret ? ret : n; } -- 2.34.1