The Wire · Showcase
KERNEL TRACING FIXES LAND BEFORE 7.2 FINAL, L2TP LEAK PLUGGED
By RepoJournal · Filed · About Linux
Steven Rostedt's tracing suite for v7.2-rc7 closes a NULL pointer dereference that crashes the kernel when module event filters are removed, while Eric Dumazet patches a refcount leak that bleeds tunnel state across proc reads.
The tracing subsystem shipped two critical fixes overnight [1] [2]. A NULL pointer dereference in the module event cache hits when userspace writes a wildcard filter for an unloaded module like ':mod:foo', then later tries to remove a specific event from it. The kernel cached that wildcard with a NULL match pointer, and passing it to strcmp() in remove_cache_mod() crashes hard. Reproduction is trivial: two writes to /sys/kernel/tracing/set_event and the box faults [2]. In parallel, Eric Dumazet closed a refcount leak in the L2TP tunnel iteration code [4]. When userspace closes /proc/net/pppol2tp before reading to EOF, the seq_file private data held tunnel and session references that never got dropped, leaking kernel memory on every early close. The wifi stack also saw a revert: the mt76 driver's NAPI disable on device removal created double-disable panics on mt7921e and mt7925e [3], where NAPI was already shut down earlier in unregister. A race condition between tracing's update_event_fields() and event_define_fields() is still under development [5]. On the userspace side, basecamp/omarchy fixed Chrome extension shortcut registration conflicts, Bluetooth discovery leaks, and wallpaper picker corruption across 28 PRs [6] [7] [8].
One email a day. Unsubscribe in one click.
Keep up with Linux in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Test v7.2-rc7 tracing fixes in your test suite, especially module-wildcard event filters torvalds/linux [plan]
- → Review L2TP proc file reading patterns in production if you expose /proc/net/pppol2tp torvalds/linux [monitor]
- → Watch for the event_define_fields() race fix in the next RC torvalds/linux [monitor]
References
- [1] Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace torvalds/linux
- [2] tracing: Fix NULL pointer dereference in module event cache removal torvalds/linux
- [3] Revert "wifi: mt76: Disable napi when removing device" torvalds/linux
- [4] l2tp: fix tunnel and session refcount leak on seq_file release torvalds/linux
- [5] tracing: Fix race between update_event_fields and, event_define_fields torvalds/linux
- [6] Free the Copy URL shortcut from ghost extension registrations (#6821) basecamp/omarchy
- [7] Suppress LocalSend's redundant tray item (#6852) basecamp/omarchy
- [8] Stop Bluetooth discovery when the panel closes ↗ basecamp/omarchy