Linux Kernel Timerlat Tracer Tracepoint Management Vulnerability

A vulnerability exists in the Linux kernel's tracing subsystem, specifically within the osnoise workload management of the timerlat tracer. When the osnoise workload option is disabled, the timerlat tracer can be started without issue. However, if the osnoise option is later enabled and the timerlat tracer is removed, the corresponding tracepoints remain active. This oversight can lead to warnings when the timerlat tracer is reactivated, as the tracepoints have not been properly disabled. The issue arises from relying on user-defined options to manage tracepoint states, rather than using a global flag to control the enabling and disabling of events. This vulnerability affects Linux kernel versions prior to 6.13.0-rc4.

Impact

Re-enabling the timerlat tracer after removing it can trigger warnings due to improperly managed tracepoint registrations, potentially leading to confusion or misinterpretation of tracing data.

Reproduction

To reproduce this vulnerability, start by echoing 'NO_OSNOISE_WORKLOAD' into the 'osnoise/options' tracepoint. Then, activate the 'timerlat' tracer. After that, enable the 'OSNOISE_WORKLOAD' option and remove the 'timerlat' tracer. The tracepoints registered during the initial 'timerlat' activation will not be disabled. If 'NO_OSNOISE_WORKLOAD' is echoed again and 'timerlat' is reactivated, a warning will be generated due to the tracepoint being registered without having been properly disabled.

Remediation

No specific remediation is provided, but users should be aware of the tracepoint management process when using the osnoise workload with the timerlat tracer.