[PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount

[PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount

[Lee Jones]

In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.

Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count.  If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.

Verify that &se->call matches file->event_call before adjusting se->ref.

Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 kernel/trace/trace_events_hist.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 00a1d8522036..71b240b609ea 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
 
 			se_name = trace_event_name(file->event_call);
 			se = find_synth_event(se_name);
-			if (se)
+			if (se && &se->call == file->event_call)
 				se->ref--;
 
 			update_cond_flag(file);
@@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 		event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
 		se_name = trace_event_name(file->event_call);
 		se = find_synth_event(se_name);
-		if (se)
+		if (se && &se->call == file->event_call)
 			se->ref--;
 		ret = 0;
 		goto out_free;
@@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 
 	se_name = trace_event_name(file->event_call);
 	se = find_synth_event(se_name);
-	if (se)
+	if (se && &se->call == file->event_call)
 		se->ref++;
  out:
 	if (ret == 0 && glob[0])
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount

[Steven Rostedt]

On Wed, 14 Oct 2026 10:30:12 +0000
Lee Jones <lee@kernel.org> wrote:

> In event_hist_trigger_parse() and hist_unreg_all(), the histogram
> registration and unregistration paths look up find_synth_event() using
> trace_event_name(file->event_call) and adjust se->ref if a match is
> found.
> 
> Because find_synth_event() only compares the event basename, registering
> or removing a histogram on a non-synthetic trace event whose basename
> matches a synthetic event erroneously modifies the synthetic event's
> reference count.  If a histogram is registered on the non-synthetic
> event before the synthetic event is created and removed afterwards,
> se->ref is decremented without a matching increment, allowing the
> synthetic event to be freed while an active histogram action still holds
> a pointer to it.
> 
> Verify that &se->call matches file->event_call before adjusting se->ref.
> 
> Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>

Hi,

Thanks for the patch...

> ---
>  kernel/trace/trace_events_hist.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 00a1d8522036..71b240b609ea 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
>  
>  			se_name = trace_event_name(file->event_call);
>  			se = find_synth_event(se_name);
> -			if (se)
> +			if (se && &se->call == file->event_call)
>  				se->ref--;
>  
>  			update_cond_flag(file);
> @@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  		event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
>  		se_name = trace_event_name(file->event_call);
>  		se = find_synth_event(se_name);
> -		if (se)
> +		if (se && &se->call == file->event_call)
>  			se->ref--;
>  		ret = 0;
>  		goto out_free;
> @@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  
>  	se_name = trace_event_name(file->event_call);
>  	se = find_synth_event(se_name);
> -	if (se)
> +	if (se && &se->call == file->event_call)
>  		se->ref++;
>   out:
>  	if (ret == 0 && glob[0])

Instead of open coding each of these, can we add a new helper function:

struct synth_event *find_synth_event_call(struct trace_event_call *call)
{
	struct synth_event *se;
	const char *name;

	name = trace_event_name(call);
	se = find_synth_event(name);
	return se && se->call == call ? se : NULL;
}

The above can be defined in trace_events_synth.c and exported like
find_synth_event() is.

Then we can remove the se_name from each of these functions.

-- Steve