* [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount
@ 2026-10-14 10:30 Lee Jones
2026-10-14 18:10 ` Steven Rostedt
0 siblings, 1 reply; 3+ messages in thread
From: Lee Jones @ 2026-10-14 10:30 UTC (permalink / raw)
To: lee, Steven Rostedt, Masami Hiramatsu, Mathieu Desnoyers,
Tom Zanussi, Fengguang Wu, linux-kernel, linux-trace-kernel
Cc: stable
In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.
Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count. If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.
Verify that &se->call matches file->event_call before adjusting se->ref.
Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
kernel/trace/trace_events_hist.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 00a1d8522036..71b240b609ea 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref--;
update_cond_flag(file);
@@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref--;
ret = 0;
goto out_free;
@@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref++;
out:
if (ret == 0 && glob[0])
--
2.56.0.385.gd3acb90ef8-goog
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount
2026-10-14 10:30 [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount Lee Jones
@ 2026-10-14 18:10 ` Steven Rostedt
2026-10-15 10:19 ` Lee Jones
0 siblings, 1 reply; 3+ messages in thread
From: Steven Rostedt @ 2026-10-14 18:10 UTC (permalink / raw)
To: Lee Jones
Cc: Masami Hiramatsu, Mathieu Desnoyers, Tom Zanussi, Fengguang Wu,
linux-kernel, linux-trace-kernel
On Wed, 14 Oct 2026 10:30:12 +0000
Lee Jones <lee@kernel.org> wrote:
> In event_hist_trigger_parse() and hist_unreg_all(), the histogram
> registration and unregistration paths look up find_synth_event() using
> trace_event_name(file->event_call) and adjust se->ref if a match is
> found.
>
> Because find_synth_event() only compares the event basename, registering
> or removing a histogram on a non-synthetic trace event whose basename
> matches a synthetic event erroneously modifies the synthetic event's
> reference count. If a histogram is registered on the non-synthetic
> event before the synthetic event is created and removed afterwards,
> se->ref is decremented without a matching increment, allowing the
> synthetic event to be freed while an active histogram action still holds
> a pointer to it.
>
> Verify that &se->call matches file->event_call before adjusting se->ref.
>
> Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>
Hi,
Thanks for the patch...
> ---
> kernel/trace/trace_events_hist.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 00a1d8522036..71b240b609ea 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
>
> se_name = trace_event_name(file->event_call);
> se = find_synth_event(se_name);
> - if (se)
> + if (se && &se->call == file->event_call)
> se->ref--;
>
> update_cond_flag(file);
> @@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
> event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
> se_name = trace_event_name(file->event_call);
> se = find_synth_event(se_name);
> - if (se)
> + if (se && &se->call == file->event_call)
> se->ref--;
> ret = 0;
> goto out_free;
> @@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>
> se_name = trace_event_name(file->event_call);
> se = find_synth_event(se_name);
> - if (se)
> + if (se && &se->call == file->event_call)
> se->ref++;
> out:
> if (ret == 0 && glob[0])
Instead of open coding each of these, can we add a new helper function:
struct synth_event *find_synth_event_call(struct trace_event_call *call)
{
struct synth_event *se;
const char *name;
name = trace_event_name(call);
se = find_synth_event(name);
return se && se->call == call ? se : NULL;
}
The above can be defined in trace_events_synth.c and exported like
find_synth_event() is.
Then we can remove the se_name from each of these functions.
-- Steve
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount
2026-10-14 18:10 ` Steven Rostedt
@ 2026-10-15 10:19 ` Lee Jones
0 siblings, 0 replies; 3+ messages in thread
From: Lee Jones @ 2026-10-15 10:19 UTC (permalink / raw)
To: Steven Rostedt
Cc: Masami Hiramatsu, Mathieu Desnoyers, Tom Zanussi, Fengguang Wu,
linux-kernel, linux-trace-kernel
On Wed, 14 Oct 2026, Steven Rostedt wrote:
> On Wed, 14 Oct 2026 10:30:12 +0000
> Lee Jones <lee@kernel.org> wrote:
>
> > In event_hist_trigger_parse() and hist_unreg_all(), the histogram
> > registration and unregistration paths look up find_synth_event() using
> > trace_event_name(file->event_call) and adjust se->ref if a match is
> > found.
> >
> > Because find_synth_event() only compares the event basename, registering
> > or removing a histogram on a non-synthetic trace event whose basename
> > matches a synthetic event erroneously modifies the synthetic event's
> > reference count. If a histogram is registered on the non-synthetic
> > event before the synthetic event is created and removed afterwards,
> > se->ref is decremented without a matching increment, allowing the
> > synthetic event to be freed while an active histogram action still holds
> > a pointer to it.
> >
> > Verify that &se->call matches file->event_call before adjusting se->ref.
> >
> > Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Lee Jones <lee@kernel.org>
>
> Hi,
>
> Thanks for the patch...
>
> > ---
> > kernel/trace/trace_events_hist.c | 6 +++---
> > 1 file changed, 3 insertions(+), 3 deletions(-)
> >
> > diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> > index 00a1d8522036..71b240b609ea 100644
> > --- a/kernel/trace/trace_events_hist.c
> > +++ b/kernel/trace/trace_events_hist.c
> > @@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
> >
> > se_name = trace_event_name(file->event_call);
> > se = find_synth_event(se_name);
> > - if (se)
> > + if (se && &se->call == file->event_call)
> > se->ref--;
> >
> > update_cond_flag(file);
> > @@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
> > event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
> > se_name = trace_event_name(file->event_call);
> > se = find_synth_event(se_name);
> > - if (se)
> > + if (se && &se->call == file->event_call)
> > se->ref--;
> > ret = 0;
> > goto out_free;
> > @@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
> >
> > se_name = trace_event_name(file->event_call);
> > se = find_synth_event(se_name);
> > - if (se)
> > + if (se && &se->call == file->event_call)
> > se->ref++;
> > out:
> > if (ret == 0 && glob[0])
>
> Instead of open coding each of these, can we add a new helper function:
>
> struct synth_event *find_synth_event_call(struct trace_event_call *call)
> {
> struct synth_event *se;
> const char *name;
>
> name = trace_event_name(call);
> se = find_synth_event(name);
> return se && se->call == call ? se : NULL;
> }
>
> The above can be defined in trace_events_synth.c and exported like
> find_synth_event() is.
>
> Then we can remove the se_name from each of these functions.
Thanks for the pointer. I'll look into it.
--
Lee Jones
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-15 10:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-14 10:30 [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount Lee Jones
2026-10-14 18:10 ` Steven Rostedt
2026-10-15 10:19 ` Lee Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®