CVE-2023-54211

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix warning in trace_buffered_event_disable()

Warning happened in trace_buffered_event_disable() at

WARN_ON_ONCE(!trace_buffered_event_ref)

Call Trace:

? __warn+0xa5/0x1b0

? trace_buffered_event_disable+0x189/0x1b0

__ftrace_event_enable_disable+0x19e/0x3e0

free_probe_data+0x3b/0xa0

unregister_ftrace_function_probe_func+0x6b8/0x800

event_enable_func+0x2f0/0x3d0

ftrace_process_regex.isra.0+0x12d/0x1b0

ftrace_filter_write+0xe6/0x140

vfs_write+0x1c9/0x6f0

[...]

The cause of the warning is in __ftrace_event_enable_disable(),

trace_buffered_event_enable() was called once while

trace_buffered_event_disable() was called twice.

Reproduction script show as below, for analysis, see the comments:

```

#!/bin/bash

cd /sys/kernel/tracing/

# 1. Register a 'disable_event' command, then:

# 1) SOFT_DISABLED_BIT was set;

# 2) trace_buffered_event_enable() was called first time;

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References