From nobody Wed Feb 11 14:20:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84D65C7618B for ; Tue, 14 Mar 2023 19:04:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230410AbjCNTEL (ORCPT ); Tue, 14 Mar 2023 15:04:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230115AbjCNTEH (ORCPT ); Tue, 14 Mar 2023 15:04:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DEE0B47B; Tue, 14 Mar 2023 12:03:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7FC6561967; Tue, 14 Mar 2023 19:03:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0ED3C4339C; Tue, 14 Mar 2023 19:03:10 +0000 (UTC) Received: from rostedt by gandalf.local.home with local (Exim 4.96) (envelope-from ) id 1pc9vR-009txZ-2h; Tue, 14 Mar 2023 15:03:09 -0400 Message-ID: <20230314190309.650483139@goodmis.org> User-Agent: quilt/0.66 Date: Tue, 14 Mar 2023 15:02:37 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Andrew Morton , stable@vger.kernel.org, Mark Rutland Subject: [for-linus][PATCH 1/5] tracing: Do not let histogram values have some modifiers References: <20230314190236.203370742@goodmis.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Steven Rostedt (Google)" Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is set to do so. Note, the histogram code was not prepared to handle these modifiers for histograms and caused a bug. Mark Rutland reported: # echo 'p:copy_to_user __arch_copy_to_user n=3D$arg2' >> /sys/kernel/traci= ng/kprobe_events # echo 'hist:keys=3Dn:vals=3Dhitcount.buckets=3D8:sort=3Dhitcount' > /sys/= kernel/tracing/events/kprobes/copy_to_user/trigger # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer dereference at virtual = address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR =3D 0x0000000096000004 [ 143.695604] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 143.695889] SET =3D 0, FnV =3D 0 [ 143.696077] EA =3D 0, S1PTW =3D 0 [ 143.696302] FSC =3D 0x04: level 0 translation fault [ 143.702381] Data abort info: [ 143.702614] ISV =3D 0, ISS =3D 0x00000004 [ 143.702832] CM =3D 0, WnR =3D 0 [ 143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=3D00000000448f9000 [ 143.703407] [0000000000000000] pgd=3D0000000000000000, p4d=3D00000000000= 00000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10= a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE= =3D--) [ 143.707120] pc : hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp : ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 00000000004= 00cc0 [ 143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303e= e5800 [ 143.708776] x23: ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 00000000000= 00001 [ 143.709127] x20: ffff10d303ec2000 x19: 0000000000000000 x18: 00000000000= 00000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15: 00000000000= 00000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 65676769727= 42023 [ 143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521= e018c [ 143.710584] x8 : 000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 00000000000= 0002c [ 143.710915] x5 : ffff10d303b0103e x4 : ffffd7a653b20261 x3 : 00000000000= 0003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 : 00000000000= 00000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642] hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125] event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521] seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043] ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [ 143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970] el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [ 143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace 0000000000000000 ]--- Segmentation fault Link: https://lkml.kernel.org/r/20230302020810.559462599@goodmis.org Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Andrew Morton Fixes: c6afad49d127f ("tracing: Add hist trigger 'sym' and 'sym-offset' mod= ifiers") Reported-by: Mark Rutland Tested-by: Mark Rutland Signed-off-by: Steven Rostedt (Google) --- kernel/trace/trace_events_hist.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 89877a18f933..6e8ab726a7b5 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -4235,6 +4235,15 @@ static int __create_val_field(struct hist_trigger_da= ta *hist_data, goto out; } =20 + /* Some types cannot be a value */ + if (hist_field->flags & (HIST_FIELD_FL_GRAPH | HIST_FIELD_FL_PERCENT | + HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2 | + HIST_FIELD_FL_SYM | HIST_FIELD_FL_SYM_OFFSET | + HIST_FIELD_FL_SYSCALL | HIST_FIELD_FL_STACKTRACE)) { + hist_err(file->tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str)); + ret =3D -EINVAL; + } + hist_data->fields[val_idx] =3D hist_field; =20 ++hist_data->n_vals; --=20 2.39.1