[PATCH] tracing: Save the event file instead of the compatible histogram

[PATCH] tracing: Save the event file instead of the compatible histogram

[Donggeun Yoo]

create_field_var_hist() creates a histogram on the matched event to
supply a field variable, and records it on the target so it can be torn
down later:

	hist_data = find_compatible_hist(target_hist_data, file);
	...
	/* Save the compatible histogram information */
	var_hist->hist_data = hist_data;

hist_data is not the histogram it creates. It is one that was already
there, whose keys the new one copies. The saved pointer has a single
user, unregister_field_var_hists(), which runs when the target is
removed:

	file = hist_data->field_var_hists[i]->hist_data->event_file;

find_compatible_hist() matches on keys alone, so it can pick one with no
variables of its own. check_var_refs() then returns false and the user
can remove it while the target still points at it:

 BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320
 Read of size 8 at addr ffff8880093b90e0 by task init/1

 Freed by task 1:
  kfree+0x154/0x420
  event_hist_trigger_free+0x1d5/0x320
  event_hist_trigger_parse+0x35f3/0x69e0
  trigger_process_regex+0x1a6/0x250

Save the event file instead. It is all the dereference ever wanted, and
it does not go away when the user removes a trigger.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260914110753.221E61F000FF@smtp.kernel.org/
Cc: stable@vger.kernel.org
Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Assisted-by: Claude:claude-fable-5
---
x86_64 under QEMU/KVM, CONFIG_KASAN=y, 2 CPUs, base 587858367581.  One
kernel config; one initramfs image per arm, differing only where stated.

A compatible histogram on sched_waking, an onmatch() target on
sched_switch naming sched_waking's prio so a field variable is forced,
then the compatible histogram removed, then the target:

  echo 'hist:keys=pid' > events/sched/sched_waking/trigger
  echo 'hist:keys=next_pid:onmatch(sched.sched_waking).my_synth(prio)' \
       > events/sched/sched_switch/trigger
  echo '!hist:keys=pid' > events/sched/sched_waking/trigger
  echo '!hist:keys=next_pid:onmatch(...)' > events/sched/sched_switch/trigger

  unfixed                        1 KASAN slab-use-after-free, above
  unfixed, 3rd command omitted   0
  patched                        0

The second arm is the control: the other three commands are identical, so
the report is the removal and not the harness.

The read is on freed memory rather than a pointer that is reliably wrong
-- whether the '!hist' still reaches the right file depends on what the
slab has handed out since.

trigger-field-variable-support.tc covers this path, and its removal step
goes through the line this patch changes.  Run by hand against both arms,
since the initramfs carries no ftracetest: inter-event histogram PASS,
field variable created PASS, field variable removed PASS, on both, with
no KASAN report on either.
 kernel/trace/trace_events_hist.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 8af97fd4ee2d..cc22bba011b2 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -549,7 +549,7 @@ struct field_var {
 };
 
 struct field_var_hist {
-	struct hist_trigger_data	*hist_data;
+	struct trace_event_file		*file;
 	char				*cmd;
 };
 
@@ -3118,8 +3118,8 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,
 		return ERR_PTR(-ENOMEM);
 	}
 
-	/* Save the compatible histogram information */
-	var_hist->hist_data = hist_data;
+	/* Needed to remove the histogram when the target goes away */
+	var_hist->file = file;
 
 	/* Create the new histogram with our variable */
 	ret = event_hist_trigger_parse(&trigger_hist_cmd, file,
@@ -6344,7 +6344,7 @@ static void unregister_field_var_hists(struct hist_trigger_data *hist_data)
 	int ret;
 
 	for (i = 0; i < hist_data->n_field_var_hists; i++) {
-		file = hist_data->field_var_hists[i]->hist_data->event_file;
+		file = hist_data->field_var_hists[i]->file;
 		cmd = hist_data->field_var_hists[i]->cmd;
 		ret = event_hist_trigger_parse(&trigger_hist_cmd, file,
 					       "!hist", "hist", cmd);

base-commit: 587858367581b9c55c3690f4e63382ad622719d4
-- 
2.53.0

Re: [PATCH] tracing: Save the event file instead of the compatible histogram

[Tom Zanussi]

On Tue, 2026-09-15 at 08:47 +0900, Donggeun Yoo wrote:
> create_field_var_hist() creates a histogram on the matched event to
> supply a field variable, and records it on the target so it can be torn
> down later:
> 
> 	hist_data = find_compatible_hist(target_hist_data, file);
> 	...
> 	/* Save the compatible histogram information */
> 	var_hist->hist_data = hist_data;
> 
> hist_data is not the histogram it creates. It is one that was already
> there, whose keys the new one copies. The saved pointer has a single
> user, unregister_field_var_hists(), which runs when the target is
> removed:
> 
> 	file = hist_data->field_var_hists[i]->hist_data->event_file;
> 
> find_compatible_hist() matches on keys alone, so it can pick one with no
> variables of its own. check_var_refs() then returns false and the user
> can remove it while the target still points at it:
> 
>  BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320
>  Read of size 8 at addr ffff8880093b90e0 by task init/1
> 
>  Freed by task 1:
>   kfree+0x154/0x420
>   event_hist_trigger_free+0x1d5/0x320
>   event_hist_trigger_parse+0x35f3/0x69e0
>   trigger_process_regex+0x1a6/0x250
> 
> Save the event file instead. It is all the dereference ever wanted, and
> it does not go away when the user removes a trigger.
> 
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/all/20260914110753.221E61F000FF@smtp.kernel.org/
> Cc: stable@vger.kernel.org
> Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'")
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
> Assisted-by: Claude:claude-fable-5

Looks fine to me, thanks.

Acked-by: Tom Zanussi <zanussi@kernel.org>

> ---
> x86_64 under QEMU/KVM, CONFIG_KASAN=y, 2 CPUs, base 587858367581.  One
> kernel config; one initramfs image per arm, differing only where stated.
> 
> A compatible histogram on sched_waking, an onmatch() target on
> sched_switch naming sched_waking's prio so a field variable is forced,
> then the compatible histogram removed, then the target:
> 
>   echo 'hist:keys=pid' > events/sched/sched_waking/trigger
>   echo 'hist:keys=next_pid:onmatch(sched.sched_waking).my_synth(prio)' \
>        > events/sched/sched_switch/trigger
>   echo '!hist:keys=pid' > events/sched/sched_waking/trigger
>   echo '!hist:keys=next_pid:onmatch(...)' > events/sched/sched_switch/trigger
> 
>   unfixed                        1 KASAN slab-use-after-free, above
>   unfixed, 3rd command omitted   0
>   patched                        0
> 
> The second arm is the control: the other three commands are identical, so
> the report is the removal and not the harness.
> 
> The read is on freed memory rather than a pointer that is reliably wrong
> -- whether the '!hist' still reaches the right file depends on what the
> slab has handed out since.
> 
> trigger-field-variable-support.tc covers this path, and its removal step
> goes through the line this patch changes.  Run by hand against both arms,
> since the initramfs carries no ftracetest: inter-event histogram PASS,
> field variable created PASS, field variable removed PASS, on both, with
> no KASAN report on either.
>  kernel/trace/trace_events_hist.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 8af97fd4ee2d..cc22bba011b2 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -549,7 +549,7 @@ struct field_var {
>  };
>  
>  struct field_var_hist {
> -	struct hist_trigger_data	*hist_data;
> +	struct trace_event_file		*file;
>  	char				*cmd;
>  };
>  
> @@ -3118,8 +3118,8 @@ create_field_var_hist(struct hist_trigger_data *target_hist_data,
>  		return ERR_PTR(-ENOMEM);
>  	}
>  
> -	/* Save the compatible histogram information */
> -	var_hist->hist_data = hist_data;
> +	/* Needed to remove the histogram when the target goes away */
> +	var_hist->file = file;
>  
>  	/* Create the new histogram with our variable */
>  	ret = event_hist_trigger_parse(&trigger_hist_cmd, file,
> @@ -6344,7 +6344,7 @@ static void unregister_field_var_hists(struct hist_trigger_data *hist_data)
>  	int ret;
>  
>  	for (i = 0; i < hist_data->n_field_var_hists; i++) {
> -		file = hist_data->field_var_hists[i]->hist_data->event_file;
> +		file = hist_data->field_var_hists[i]->file;
>  		cmd = hist_data->field_var_hists[i]->cmd;
>  		ret = event_hist_trigger_parse(&trigger_hist_cmd, file,
>  					       "!hist", "hist", cmd);
> 
> base-commit: 587858367581b9c55c3690f4e63382ad622719d4