From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEAFC4AA004; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150575; cv=none; b=VV26Au9RTPCVSR3fOsDUMCjRsJzwkHEqkH062B029Vf1mmaWBvsyd0XcNLYorKPZvt+sEnkIjPswknpOgLJVUP+AMYHQlHqMOD6SYodaUeYP5UXXan9W3BH6hyZqb7JvAZW6RS2ZIfQCEiH8iZ7DimJEUPRvdhdlwUp2cDLFGpE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150575; c=relaxed/simple; bh=qYLMiVKK6zjyD8bmH8Esu0n7Bl8j8Sp9pi3Bihw0Fkk=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=b5aW8Lxott8zZGNQwXw7hwkgf46vtBqlQdVbluSXHnwn3fViXYrYIiEiGtrwaVIehlZ3NJOZz6deaWsTMT4CqDOp7Ai8Q7XLDD7wRnREQHqxoqxFUIAVr2ELwNIbR4Y2mpxW8eYj85fTK79B+g2Ap8dZ2mQFP2jfW3Vq1d74sZo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CnOPVoyt; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CnOPVoyt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB7BA1F00898; Fri, 11 Sep 2026 18:16:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150566; bh=+nf/HO39DONnuB58jcSRhWKK+JCveE1e662v4bfwgsM=; h=Date:From:To:Cc:Subject:References; b=CnOPVoythMVBeMBYbw5yxugxvYMT0nHnwUnTPh/qcORd0jizMVGql91ItpAFZEPIs gqTZLmEsDuXrubX4OhZLYa7E2EMoyEtig5WeNhvwqCr2i1pxAGbGSac8QlW1L8rwbQ xMCihn7qQpPxJA02S6vDCSwLoP/eSO3O/NQWeDDrmUb5iLZHwf669NIdM9PYKrwGSz T4xC8GlDe1Zyg2Wn9dly4Z+u4d+U8MFp94QEOn3Fq0/r9UZdIuoQj23tXE+CYLK3D5 e7wH4QS1wa4lQNytnFKGojDIswDudJyxhoUgzmd6oVM/eRfVqs73p/ij31oGJknkoy MsSB+xzINloFw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oW-000000094v1-2Ahp; Fri, 11 Sep 2026 14:17:28 -0400 Message-ID: <20260911181728.313951151@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:37 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Henry Martin , Beau Belgrave Subject: [for-linus][PATCH 01/20] tracing/user_events: Dont destroy fields when event removal fails References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Henry Martin destroy_user_event() destroys the event's fields before attempting to remove the trace event call. If user_event_set_call_visible() fails, e.g. because the event is still enabled and trace_remove_event_call() returns -EBUSY, the event is left registered with an irreversibly destroyed field list. Any subsequent interaction with the event then operates on an empty field list while it is still fully visible in tracefs. Move the field destruction after the call removal, and splice the field list back onto the event when the removal fails so the event remains in a consistent state. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260904115223.2976446-1-bsdhenrymartin@gmai= l.com Fixes: 7f5a08c79df35 ("user_events: Add minimal support for trace_event int= o ftrace") Signed-off-by: Henry Martin Reviewed-by: Beau Belgrave Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_user.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_u= ser.c index 93cda2f6f269..f658c3a77aa7 100644 --- a/kernel/trace/trace_events_user.c +++ b/kernel/trace/trace_events_user.c @@ -1122,10 +1122,9 @@ static void user_event_destroy_validators(struct use= r_event *user) } } =20 -static void user_event_destroy_fields(struct user_event *user) +static void user_event_destroy_fields(struct list_head *head) { struct ftrace_event_field *field, *next; - struct list_head *head =3D &user->fields; =20 list_for_each_entry_safe(field, next, head, link) { list_del(&field->link); @@ -1502,17 +1501,32 @@ static int user_event_set_call_visible(struct user_= event *user, bool visible) =20 static int destroy_user_event(struct user_event *user) { + LIST_HEAD(fields); int ret =3D 0; =20 lockdep_assert_held(&event_mutex); =20 - /* Must destroy fields before call removal */ - user_event_destroy_fields(user); + /* + * Detach the fields before removing the call. Removing the event + * frees the field list memory (trace_destroy_fields() is run on + * successful removal and kmem_cache_free()s the fields), but the + * fields here are allocated and owned by user_events. Destroy + * them separately once removal has succeeded. + */ + list_splice_init(&user->fields, &fields); =20 ret =3D user_event_set_call_visible(user, false); =20 - if (ret) + if (ret) { + /* + * Removal failed and the event stays registered, recover + * the fields so it is left in a consistent state. + */ + list_splice(&fields, &user->fields); return ret; + } + + user_event_destroy_fields(&fields); =20 dyn_event_remove(&user->devent); hash_del(&user->node); @@ -2212,7 +2226,7 @@ static int user_event_parse(struct user_event_group *= group, char *name, put_user_lock: mutex_unlock(&event_mutex); put_user: - user_event_destroy_fields(user); + user_event_destroy_fields(&user->fields); user_event_destroy_validators(user); kfree(user->call.print_fmt); =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDC214AA1E4; Fri, 11 Sep 2026 18:16:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150577; cv=none; b=NECDPvvtJ/7nAh/LyTap3ohh6oyTlsZPfWr1IDMJoTR2Kj931l/lI8rm4I9FyFHAo9muu9LnEDg9EiK4Ah6E72FsBMkN/sM5YNlF42UYdDDp5DNl0GgwYKdl1euojmvYcqz/oz+EMvUl2X4+Y2JPx/ZiVXVzbQh7sQT82u5aOAY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150577; c=relaxed/simple; bh=unD1bACTbEL3QbNRseqgPpbhjnVkE5+IG8xF41To1EI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=bCarv/X5NUGjtA2tzK9G2OQCwRMlhbF2kk2jmcEbbWj+k8J3RYfrGA7eGZEH4gKet0x6guCBeQ5vA0ggOWUpo3LjAzkZh1hn5CfM3cyVdEPMBYEmBU4vVQYVEsllIYb+Mkvp34pcDw/gzHNz/HFtPrwNhY6XbkVVuWjiQREDDMU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iZlnZvSP; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iZlnZvSP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13C831F0089A; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150567; bh=7aBkvDAjs0rhAtrLr4xdw2vsPlHvsQzthg8lSC73E0o=; h=Date:From:To:Cc:Subject:References; b=iZlnZvSPk7pUxcflIhM2uPzZasm3skZ1jyQcuSKJtMnLtGofumD0s2dG9AaD443xb eAuAs5rMT1TyYvFwm+2MSanJUyc7duxJn8i6enFLtPb/IS7hnNsE4sPOUOq1zzfBpZ ZTLZEm+t1bdKFgO6S8WE8YrOztO8Phb1kvOD2Q6aQFuBvzd4gV9NiT7ABzNQgnjAi3 wacaEm7FXflDdp4wft7wuC7Hogf7MNqNdJRjphFkL7fLwUndSUKFH8tCWtP1XAsYmk Ox1+mhPCYBpHi8WomvXfDM5jmtJiBGWRqjYYXwBnMWUB3rjK2tFY2RHf32WY+7NShp 4yGtpu23dK6Qg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oW-000000094vZ-37Ue; Fri, 11 Sep 2026 14:17:28 -0400 Message-ID: <20260911181728.537106536@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:38 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Bradley Morgan , =?UTF-8?q?J=C3=A9r=C3=A9my=20Jean?= Subject: [for-linus][PATCH 02/20] ftrace: fork: Initialize function graph state before copy_exec_state() References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: =3D?UTF-8?q?J=3DC3=3DA9r=3DC3=3DA9my=3D20Jean?=3D dup_task_struct() copies the parent's task_struct, including ret_stack. ftrace_graph_init_task() clears the copied function graph state, but it currently runs after copy_exec_state(). For non-CLONE_VM forks, copy_exec_state() allocates a new task_exec_state. If that allocation fails, copy_process() reaches bad_fork_free and free_task() calls ftrace_graph_exit_task(). Since the child still carries the parent's ret_stack pointer, the unwind frees the parent's active function graph return stack. The parent subsequently accesses freed memory from function_graph_enter_regs(). KASAN reports: [ 22.190920] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 22.195899] BUG: KASAN: slab-use-after-free in function_graph_enter_regs= +0xa76/0xb90 [ 22.200747] Write of size 8 at addr ff110000054dc0a8 by task repro/1 [ 22.205134] [ 22.210770] CPU: 0 UID: 0 PID: 1 Comm: repro Not tainted 7.2.0-07732-g93= 28b3b03bdc-dirty #3 PREEMPT(lazy) [ 22.212576] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = 1.16.3-debian-1.16.3-2 04/01/2014 [ 22.213750] Call Trace: [ 22.215271] [ 22.216242] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.217774] dump_stack_lvl+0x4e/0x70 [ 22.220531] print_report+0x157/0x4b4 [ 22.223202] ? fixup_red_left+0x9/0x30 [ 22.224407] ? complete_report_info+0x83/0x110 [ 22.226679] ? function_graph_enter_regs+0xa76/0xb90 [ 22.228084] kasan_report+0xce/0x100 [ 22.230109] ? function_graph_enter_regs+0xa76/0xb90 [ 22.232860] ? stack_trace_save+0x4/0xd0 [ 22.234156] function_graph_enter_regs+0xa76/0xb90 [ 22.236090] ? kasan_save_stack+0x30/0x50 [ 22.237752] ? __pfx_function_graph_enter_regs+0x10/0x10 [ 22.238694] ? ring_buffer_lock_reserve+0x345/0xf80 [ 22.239628] ? stack_trace_save+0x4/0xd0 [ 22.242121] ? stack_trace_save+0x4/0xd0 [ 22.243588] ftrace_graph_func+0xda/0x160 [ 22.245362] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.246520] 0xffffffffa0000095 [ 22.250528] ? stack_trace_save+0x9/0xd0 [ 22.251757] ? ring_buffer_unlock_commit+0x11d/0x5c0 [ 22.253152] stack_trace_save+0x9/0xd0 [ 22.254264] kasan_save_stack+0x30/0x50 [ 22.273631] kasan_save_track+0x14/0x30 [ 22.276763] kasan_save_free_info+0x3b/0x70 [ 22.278296] __kasan_slab_free+0x43/0x70 [ 22.280157] kmem_cache_free+0xbf/0x3b0 [ 22.282963] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.284001] free_task+0xa2/0x160 [ 22.285699] ? ftrace_stub_direct_tramp+0x10/0x10 [ 22.286752] copy_process+0x2aae/0x7bc0 Initialize the child function graph state immediately after dup_task_struct(), before the first fallible operation. Cc: stable@vger.kernel.org Fixes: 6b1c66c9cca9 ("exec_state: relocate dumpable information") Reviewed-by: Bradley Morgan Link: https://patch.msgid.link/20260822195321.962383-2-Jeremy.Jean@oss.cybe= r.gouv.fr Assisted-by: Codex:gpt-5 Signed-off-by: J=C3=A9r=C3=A9my Jean Signed-off-by: Steven Rostedt --- kernel/fork.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/fork.c b/kernel/fork.c index 416758c8a3d4..a5934a317634 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2133,6 +2133,11 @@ __latent_entropy struct task_struct *copy_process( p =3D dup_task_struct(current, node); if (!p) goto fork_out; + /* + * Must run before the first fallible op, so error paths never + * free the parent's ret_stack. + */ + ftrace_graph_init_task(p); retval =3D copy_exec_state(clone_flags, p); if (retval) goto bad_fork_free; @@ -2159,8 +2164,6 @@ __latent_entropy struct task_struct *copy_process( */ p->clear_child_tid =3D (clone_flags & CLONE_CHILD_CLEARTID) ? args->child= _tid : NULL; =20 - ftrace_graph_init_task(p); - rt_mutex_init_task(p); raw_spin_lock_init(&p->blocked_lock); =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4BC6A4AA593 for ; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150571; cv=none; b=LW7PDfKw1wvveCCeLlRpL/bOqDd1QoJVmuKOkCiwuhL3UtZ0TMIo7r7XPpzI4gmJbCdCvyzkVmx0rifJq9+GZxCXM4mkBF7gvkJgl57ZPIt72gsJnBm9ZCOapCBOn2vvl+Tei53IOwhs31sVzZzquATzHG1ykdPZo261eP4Y0sg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150571; c=relaxed/simple; bh=/dXltKE1uWt63xL7vxgzBA2r0GARK1HXIChg0CjL+YI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=V2A/EWC60RuuG+Zbbl+fLJ10snW54T0ucJKCk4oAOHfF5M2n/184ft48VogBWiTYzsikXKwpXSDJgADeJNG3IorKTxGUW049rSLiDq2HoMzUTAzYXIYZJdfcIlHFGsOKvKNl8/YDsj2B1MdOLaQPTDH9WpTrkkLtlbXF/zIJXeo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lxHeh5+2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lxHeh5+2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52B971F00893; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150567; bh=XWcjwC5fgxx+7KGLp4IBpaCrJA71ftjVcULn4yY2ecI=; h=Date:From:To:Cc:Subject:References; b=lxHeh5+20Ra4eAAryS+uDTVknwiW3IWpZegteYBjJIg86NopfTOL/2GKYxpGTFdeY ri8H5dfnNV4Jbx179V9pBuMeWDCPpEuSCwhdCjCEY1XLQcBbPZKtEb3g2XClRXjKUk lsVvyS68T0F2ApH2RXSI+dGNHf/2SrPCbrS2D8TsEU51CYNWcbk59LoagxxN7KhmlH HqfbBYT1ZjtRiRoX3d8pKPvDnz3h3oR9Hx5eeERtH/DGpiKsjt1k8h8W46GWhOPfY3 k2KULYucO8L5HXZgq9r0Ix8J2RzKNx1+EJcXBbyJN8OAuK1L9R+fnliu78f1Nz7aR1 ilN9+HQ4Wz3Lw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oW-000000094w7-43Fb; Fri, 11 Sep 2026 14:17:28 -0400 Message-ID: <20260911181728.762216562@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:39 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Donggeun Yoo Subject: [for-linus][PATCH 03/20] fgraph: Remove unused FGRAPH_MAX_INDEX References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo FGRAPH_MAX_INDEX has no user, and it expands to FGRAPH_INDEX_SIZE and FGRAPH_RET_INDEX, neither of which is defined anywhere in the tree. It was added in that form by commit 91c46b0aa917 ("function_graph: Implement fgraph_reserve_data() and fgraph_retrieve_data()"), which introduced the current data word layout under new names, so anything referencing it would have failed to build ever since. Remove it. Link: https://patch.msgid.link/20260905211922.1196366-1-donggeunyoo.kernel@= gmail.com Signed-off-by: Donggeun Yoo Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- kernel/trace/fgraph.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index 40d373d65f9b..ed455b53513b 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -143,9 +143,6 @@ enum { #define FGRAPH_DATA_INDEX_MASK GENMASK(FGRAPH_DATA_INDEX_BITS - 1, 0) #define FGRAPH_DATA_INDEX_SHIFT (FGRAPH_DATA_SHIFT + FGRAPH_DATA_BITS) =20 -#define FGRAPH_MAX_INDEX \ - ((FGRAPH_INDEX_SIZE << FGRAPH_DATA_BITS) + FGRAPH_RET_INDEX) - #define FGRAPH_ARRAY_SIZE FGRAPH_INDEX_BITS =20 /* --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AFB9D4ADD92; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150575; cv=none; b=iiDYafn+XTSAYtv5ZGINO0UlAn3kdegLuE+TK0QMjS95lJAz683u3XA+xRdCH1a+hsI6xu2Y+Sfr+hYmkQud9Uc2a1rUK0wJh5+h2rGUt3JMpjyMHPhJUctNL48Oauha5/cXOvcM3zOcbc0ma+Ep/ggLxKZ4pjR3NFiutcffHfo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150575; c=relaxed/simple; bh=pu7x1XTrqqwnrBHe1bktobDFHaD4drtP5XdJGehu0ZY=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=CcbXzpqygPvHa4hVuQNebPYHYjhouH2bYyM27//hqhFZ6P12tHqKFLMgsGSVMrrlhFW0S4Ppe8B7mtILiw2BRmjL+FdQA3iRLRHb313KKcvP83Tij1YxSmG+KBFj+6ewApSu36O2j61Pl2healdxo5u9s4qDTkWyaH/L4JWRrrs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DMV1Rlgf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DMV1Rlgf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D04C1F0089B; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150567; bh=yKOQItjO/28zKn73DW1wyeZAtLYzsp22WZJIlvBneeQ=; h=Date:From:To:Cc:Subject:References; b=DMV1RlgfnQQQDqFszgGmcoMAxYifI06AwEMC4xfXYGp0PKNO3xv2/Wj/Wcqh/q0/T i7mt7RPx0phpsiv6xDIjX5agGpxGQOzNIYqhnraaHYGAZxCwYb1Lw5OYZAJPmd4MRx QgLDNQ9QMzI3hqHroXa01WQZEMJj3ZlT/Ql02U1L9WLnOaVXABtdZ4RqOVN5Dpj14M iJiB6nvJGU6hZF6zDDyhWTNqCfRipVj3NAN09PjF3pEGzRMwRBe5zgMYGAU1S8ld4I aYboM/5Iy14x6fR7dTHK+duxe0MLuwhODjBWO0sea4dJvbNOBQDd3ATRqsNrFeCyA4 aT/oYVUvdnY6A== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oX-000000094wf-0lon; Fri, 11 Sep 2026 14:17:29 -0400 Message-ID: <20260911181728.983943214@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:40 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 04/20] function_graph: Use the saved entrys size when reprinting it References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo When a graph entry does not fit in the trace_seq, print_graph_entry() saves it in the iterator's fgraph_data and reprints it on the next read. The entry has already been consumed from the ring buffer by then, so the copy is all that is left of it. The copy is sized with iter->ent_size, which no longer describes the saved entry but whatever entry the iterator has moved on to. The argument count is derived from the same field, so a 72 byte entry saved and then reprinted ahead of a 48 byte return entry loses its arguments. Record the size next to the failure flag, so that the two are always set together, and restore it before reprinting. Cc: stable@vger.kernel.org Fixes: ff5c9c576e75 ("ftrace: Add support for function argument to graph tr= acer") Link: https://patch.msgid.link/20260906034406.1335316-1-donggeunyoo.kernel@= gmail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_functions_graph.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_func= tions_graph.c index ff7cb1a76b95..c5befd0c5b9a 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -52,6 +52,7 @@ struct fgraph_data { }; struct ftrace_graph_ret_entry ret; int failed; + int ent_size; int cpu; }; =20 @@ -1274,6 +1275,7 @@ print_graph_entry(struct ftrace_graph_ent_entry *fiel= d, struct trace_seq *s, if (s->full) { data->failed =3D 1; data->cpu =3D cpu; + data->ent_size =3D iter->ent_size; } else data->failed =3D 0; } @@ -1457,6 +1459,7 @@ print_graph_function_flags(struct trace_iterator *ite= r, u32 flags) if (data && data->failed) { field =3D &data->ent.ent; iter->cpu =3D data->cpu; + iter->ent_size =3D data->ent_size; ret =3D print_graph_entry(field, s, iter, flags); if (ret =3D=3D TRACE_TYPE_HANDLED && iter->cpu !=3D cpu) { per_cpu_ptr(data->cpu_data, iter->cpu)->ignore =3D 1; --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21D0E4AE8B9; Fri, 11 Sep 2026 18:16:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150578; cv=none; b=UIZbMqzSutT2aLT4YPJ2kJPTTg+7QrJtBIvTJmCZr0BLBOhbpn+oruM12sE2SKVgSwN/uViySHzrSIsN/dIIeJIRLKefYp2+SAhpTR5s8z9ddCpt5d9tcsqcI9t9xCh5G04JQx0cXbd4SAk3Eq3smeJcAfuR9eUvfzOQx/yKoOY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150578; c=relaxed/simple; bh=GRy30mPrKsmZqYHkolwR0BH5LGcF8NucrorcdLX3O0U=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=QSe5MI1QysgnQQn4n0O7VI6NcuOYiq/avrnzv4SbR6mtU3jt27PAJnMTX+aZFyOlgeuPnGyo4FeKmyjbbK0bB9SKJIHnxVMsOHIfeNpC6KfUW1D5CEEsj2JH+hHxo9uFyuY85QVEANNQvuj7R1duCbSJuI0gmyncAE/LaLuj6e0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OXSREkg0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OXSREkg0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3AAD1F00899; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150567; bh=7CZ9L8vKur9/k1BJWSUjY4fdFdddK3Rscatnfc5pQ8I=; h=Date:From:To:Cc:Subject:References; b=OXSREkg0AZI0Kl/nnS6/ciSvNz6KMtLxndFov6cJHpsnIGDjDzWOUGvDWd7NxpJbl /50o5ydviGLeeoARrXaZYoAoH/tbwLyUpB+1rulpFsBtE80sr+PCMxt1MdiGWTQI4B oTMXQAbZDRwXbAmfMWTrf7Rk7VyYCfisbc50svz4XyZ2xpAtfE20HWMwuwn/OoECSs TgBaA1CYU7syIUUc2HWlTFoVfYTVajWN/GgzkSda6xCvnbJUpw0o3FtREnOd6q5o3r enii5JB6EOVBTPX45Ph5qA8zCxz6x4AKjC4/HYQw2KauWN7qOrmlSkHLmsUyL7kcDl s2n1ZhHD4zNHg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oX-000000094xE-1gnj; Fri, 11 Sep 2026 14:17:29 -0400 Message-ID: <20260911181729.202464280@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:41 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 05/20] tracing: Free histogram var refs regardless of how often they are referenced References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit 656fe2ba85e8 ("tracing: Use hist trigger's var_ref array to destroy var_refs") made a trigger's var_refs[] array the only owner of a var ref: destroy_hist_field() returns early for HIST_FIELD_FL_VAR_REF, so the field expressions never destroy one. One entry, freed once, no count needed. commit 8bcebc77e85f ("tracing: Fix histogram code when expression has same var as value") then made repeated references share one object and added a count of them. Only the increment side exists, since those expressions still return early and never drop a reference, so __destroy_hist_field() sees how many references were created rather than how many are left. It frees when the decremented count is 0 or 1, so two references work and three or more leak. Sharing kept one array entry per object, and create_var_ref() searches and appends within a single trigger, so nothing outside it holds the object. Removing a trigger whose variables are still referenced is already refused by check_var_refs() with -EBUSY. Drop the count and free unconditionally. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260906124025.3550596-1-donggeunyoo.kernel@= gmail.com Fixes: 8bcebc77e85f ("tracing: Fix histogram code when expression has same = var as value") Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 963e0d6b61fd..f90680b33a37 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -169,7 +169,6 @@ struct hist_field { struct hist_field *operands[HIST_FIELD_OPERANDS_MAX]; struct hist_trigger_data *hist_data; enum hist_field_fn fn_num; - unsigned int ref; unsigned int size; unsigned int offset; unsigned int is_signed; @@ -1913,16 +1912,8 @@ static int contains_operator(char *str, char **sep) return field_op; } =20 -static void get_hist_field(struct hist_field *hist_field) -{ - hist_field->ref++; -} - static void __destroy_hist_field(struct hist_field *hist_field) { - if (--hist_field->ref > 1) - return; - kfree(hist_field->var.name); kfree(hist_field->name); =20 @@ -1969,8 +1960,6 @@ static struct hist_field *create_hist_field(struct hi= st_trigger_data *hist_data, if (!hist_field) return NULL; =20 - hist_field->ref =3D 1; - hist_field->hist_data =3D hist_data; =20 if (flags & HIST_FIELD_FL_EXPR || flags & HIST_FIELD_FL_ALIAS) @@ -2223,10 +2212,8 @@ static struct hist_field *create_var_ref(struct hist= _trigger_data *hist_data, for (i =3D 0; i < hist_data->n_var_refs; i++) { ref_field =3D hist_data->var_refs[i]; if (ref_field->var.idx =3D=3D var_field->var.idx && - ref_field->var.hist_data =3D=3D var_field->hist_data) { - get_hist_field(ref_field); + ref_field->var.hist_data =3D=3D var_field->hist_data) return ref_field; - } } /* Sanity check to avoid out-of-bound write on 'hist_data->var_refs' */ if (hist_data->n_var_refs >=3D TRACING_MAP_VARS_MAX) @@ -3276,7 +3263,6 @@ static struct hist_field *create_var(struct hist_trig= ger_data *hist_data, goto out; } =20 - var->ref =3D 1; var->flags =3D HIST_FIELD_FL_VAR; var->var.idx =3D idx; var->var.hist_data =3D var->hist_data =3D hist_data; --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3BA904A9D7C; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150578; cv=none; b=gACfYXwL4ZRP/yoxvXAoGll4b/KCry2O+4P6gba8giPjhNEmLzAqH/qmHEFDTjMKYOGbR0dUftGIlztW611GkVDN/UqamZeW1AZcOZ9TyGsMNFrdmm7rs0q/Ugb6ynWQTfiFPBj6rnP7773jiGkZE4dvhSlfqlM4uXl/ONa+9fk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150578; c=relaxed/simple; bh=vIFLuivCeQ5Xw5/AowTYuazWOvl3GwU4HZGEW5vQMmw=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=CMb238kXpGeOQdUcZdlQoNPUr4hihr5HTyS1MuFovzt1qzlIUMQE6NQSZ177Pkc4kKmsyWTgjzJiXWkE7gJdkfOT/ng1NOgpji9pZAZ+Z9BbuR22yJe7sBlJ/ZrIHZrFEdqXkXF5VN4hLV4RZUk7hfMbbPbrda0KnZ5Uo+Pfk6s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MlAz6xK1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MlAz6xK1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E53C71F0089D; Fri, 11 Sep 2026 18:16:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150567; bh=lTmwD2rLpAi7kXIGGvh7B7Act95huXSlJg38wH9ougM=; h=Date:From:To:Cc:Subject:References; b=MlAz6xK16bI9tf/mfS2d2yF9XYw4pqeLAQgY+AWxzfudptxWZv0VRNo9pskQ7iylu VPjsmAnHmcA0L+XxEeiV76aCP3lQ8ivJG1vTF51DcpiCkpvxA605WLHqQ/L1dBMzR9 6wjEHlT4krDDxe9kAl7loGPKIZRv072gGFo4td1Y8VlkuQjhm1fTUSRX6CvVxO+GvM Rhsp050x4RwoSS8drPkf6bzjilUgTQu6cuFqlPYURLrQ7jFiYoDNGV+72UjCTBTwZU F3Rb8f8MVrHC1MrUialvq8T2KGzbMX9H4tMGGftI+OTu6fvqAInKmz1KkIQ3Ml56Y6 f5kLwrkkf4GFA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oX-000000094xo-2XBO; Fri, 11 Sep 2026 14:17:29 -0400 Message-ID: <20260911181729.421437849@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:42 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 06/20] tracing: Free histogram the var ref when its initialization fails References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo create_var_ref() allocates a VAR_REF hist_field and then calls init_var_ref() to fill it in. When that fails the field is leaked. commit 656fe2ba85e8 ("tracing: Use hist trigger's var_ref array to destroy var_refs") made destroy_hist_field() return early for HIST_FIELD_FL_VAR_REF, since var refs are freed by walking the trigger's var_refs[] array instead. create_var_ref() adds the field to that array only after init_var_ref() has succeeded, so on this path the field is in neither place and nothing frees it. The call was correct when it was written, before var refs were taken out of destroy_hist_field(). init_var_ref() cannot free it either. The caller owns the field, so init_var_ref() undoes only its own string allocations and leaves the field alone. Freeing it there would leave create_var_ref() passing freed memory to destroy_hist_field(), which reads its flags. Call __destroy_hist_field(), which frees the field without consulting the flag. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260906133352.3815019-1-donggeunyoo.kernel@= gmail.com Fixes: 656fe2ba85e8 ("tracing: Use hist trigger's var_ref array to destroy = var_refs") Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index f90680b33a37..bbdd56208eff 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2221,7 +2221,7 @@ static struct hist_field *create_var_ref(struct hist_= trigger_data *hist_data, ref_field =3D create_hist_field(var_field->hist_data, NULL, flags, NULL); if (ref_field) { if (init_var_ref(ref_field, var_field, system, event_name)) { - destroy_hist_field(ref_field, 0); + __destroy_hist_field(ref_field); return NULL; } =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBEEE4AEBF5; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150580; cv=none; b=fJBAfGlk1fw7AAuFvEWKMKY1yVEPldkuiQK6Dw0ScEdTdhD+1Pgtc+7mE9IImDoOrjCIZyFl/ShTz1REIIP4fcU/6POCSeQtIjVRnkPASBAGAujiW8ysz4Eu1VP68fs8Dxku16VfbFMdOLwfbrpWjXqsmzHgj61pA5mQ4ULDRig= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150580; c=relaxed/simple; bh=QSD3eMCLrLuQgTXh7gAKcKxBIwLo7qPxGf2rRAEPZEU=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=JhZWqJktRH0JVHs820j3LXFgzFuHwmhjJwenO237pIvFB0/4TO7weRi73iaux93b0PN7D4DSVgPChuO3uPNeGy6UgQ+ZtE5CC9r1FZqEvr98WmF7kw4To1RIi0+q1E35PB4gcPC5sLk9PRTrWF6HS5bm1d09sGRQpi87PMyhCg8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=h3IUTb76; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="h3IUTb76" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3105B1F0089C; Fri, 11 Sep 2026 18:16:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150568; bh=bL/rSYTIGCPz2ML0qUfMnK6Kt8ZSclOopkEza4Oddx4=; h=Date:From:To:Cc:Subject:References; b=h3IUTb76WsZKGoO96+ZL26cjzLbvlgRpKICsFfxBuC346VMm7qBdNfDQQLk/giFKW AjSHpinvkDzHwWOAV6n+mvwNYl74tDrXbIScd32Z/od7RHI4O14JbfYHI+o2YXfrcc uPpK4r12aQqE3c4L9U10cOY3w0TbMd2uWXoM68FpI27Ae/zAJkEd346WECBqdMtsOz V4Dzpk4HO5qJFiAJvKw+cSYz4u4VK1KXjjaj6p4yXs/Pm2jTG+T7X5+DkT8HtEcDxu LvQx84EoycGvgnJDKiR/6x8336TQzbBUlv0m89C+dsIT8LnFCjAaxPLQz4fO3rl972 D8h4B8Wzoz5+A== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oX-000000094yM-3NFq; Fri, 11 Sep 2026 14:17:29 -0400 Message-ID: <20260911181729.623284631@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:43 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 07/20] tracing: Free histogram the field rejected for a bad modifier References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. __create_val_field() takes the field from parse_expr() and stores it in hist_data->fields[] only after the modifier checks have run: hist_field =3D parse_expr(hist_data, file, field_str, flags, var_name, &n_subexprs); ... if (hist_field->flags & HIST_FIELD_FL_VAR) { if (hist_field->flags & (...)) goto err; } else { if (hist_field->flags & (...)) goto err; } hist_data->fields[val_idx] =3D hist_field; Both checks jump past that store, and the err label returns without freeing anything. The error unwinds to create_hist_data(), which calls destroy_hist_data() -> destroy_hist_fields(), and that reaches a field only by walking fields[]. A field that never got there is unreachable. commit e0213434fe3e ("tracing: Do not let histogram values have some modifiers") set ret to -EINVAL and fell through to the store, which left the field owned by fields[] and freed along with the rest of hist_data. Splitting the check into a value case and a variable case replaced that fall-through with a goto that skips it. With CONFIG_DEBUG_KMEMLEAK, 200 writes of # echo 'hist:keys=3Dprev_pid:vals=3Dnext_pid.log2' > \ events/sched/sched_switch/trigger each correctly rejected with -EINVAL, leave 332 unreferenced objects (63744 bytes) reported at create_hist_field(); 200 install and remove cycles of a valid trigger leave none. A '.log2' field is two allocations, since create_hist_field() puts the plain field in operands[0] of the log2 field, and both are reported. Use destroy_hist_field() rather than __destroy_hist_field() so that operands[0] is freed as well. It returns early for HIST_FIELD_FL_VAR_REF, which is what an operand owned by hist_data->var_refs[] needs; the rejected field itself is never a var ref, because a var ref never carries a modifier flag. Cc: stable@vger.kernel.org Fixes: e30fbc618e97 ("tracing/histograms: Allow variables to have some modi= fiers") Link: https://patch.msgid.link/20260907034948.240387-1-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index bbdd56208eff..8cad99a8d01e 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -4317,6 +4317,7 @@ static int __create_val_field(struct hist_trigger_dat= a *hist_data, return ret; err: hist_err(file->tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str)); + destroy_hist_field(hist_field, 0); return -EINVAL; } =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC0374AEBF9; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150580; cv=none; b=p+AB0cEL7H0hEcxUDYUaDiS1BSTCP4u3mswSBh5PJm1PGOiOGo6jtUEi/SNCl6qPqiLj7iNA9EIJQOG2GQ69UbClzaf3qq6+Kqs6TOvz9Yg+kUUQkW3WoGBjVOc6J12VT3taO+BADA4DgrI7Lb0JnGHCw/kceO+jXxF5okK92Gg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150580; c=relaxed/simple; bh=ESv02GWyTuZyme+ZIbqMPOevUrjH5HoNJruHBg9X3pE=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Vo0GgYMOBj8q/WVAn1i94UmfesgUSNqWiEljQ+N+kbQdtZZQe2HDOYzz6Wptm9vX+PJ5+Z2JECfB2j2GDLX+vd3F055RYR79N8RCfNxQ+/xrAPCMSq4kd4YL/785Zn2pxiuZJLgQ9nRTyMN7jz6sZZ0nKuT2I4Xq+4ozuvt+LVM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KgFOD70w; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KgFOD70w" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6BDB61F0089E; Fri, 11 Sep 2026 18:16:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150568; bh=vIILeZZui+JTV57AhAjUl87zg5bT89Mh3Q5N+4tiYZ0=; h=Date:From:To:Cc:Subject:References; b=KgFOD70wbFkqaQvkJuuIVXSjds15VEn+IKaswo9d9f4p5MOazgDr8ublO8dJpsaqO xki4M31uHu7W7FIalkS21Oc6rcMaHzURqDRMFXuIbNp031TL+22RqHc+ai26P+lDxw mH+9EdELuv+66QWnxOVpqTPru9L542RBsJZPZxRLCU8sCsX9vRCNtX8ITpwdqC1MBF m0tswrjb8Z1qiM6EkLOOLjF47qLUvEDlmBJm42NkT10Kein5upxY3ea8jNoeBg5NFW PEqdJaMmzt/NOmng/enmg0p1fZU5gNxb6SPcPTkxCgO4ycEcp9zMXq0HvhDiJ8VTN8 svAbrAxh3MS7A== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oY-000000094yv-02Oa; Fri, 11 Sep 2026 14:17:30 -0400 Message-ID: <20260911181729.830006531@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:44 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, sashiko-bot@kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 08/20] tracing: Keep the entry count when the histogram stats allocation fails References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo print_entries() uses n_entries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrites the count that the cleanup still needs: n_entries =3D tracing_map_sort_entries(map, ...); if (n_entries < 0) return n_entries; ... if (!stats) { n_entries =3D -ENOMEM; goto out; } ... out: tracing_map_destroy_sort_entries(sort_entries, n_entries); tracing_map_destroy_sort_entries() takes an unsigned int and loops up to it, so -ENOMEM arrives as 4294967284. It walks an array of at most map->max_elts pointers and calls destroy_sort_entry(), which dereferences and frees, on whatever lies past the end. Reading the hist file of a trigger with a .percent value, with that allocation forced to fail: BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0xa= 0/0xb0 Read of size 8 at addr ffffc90000045000 by task init/1 tracing_map_destroy_sort_entries+0xa0/0xb0 hist_show+0x6f7/0x1df0 seq_read_iter+0x2b8/0x1190 vfs_read+0x176/0xa40 The buggy address belongs to a 4-page vmalloc region starting at ffffc90000041000 allocated at tracing_map_sort_entries+0x5c/0xd50 A few pages further the fault is fatal. The registers at the oops confirm the bound: the loop's end pointer less the array start, over the pointer size, is 4294967284. Return the error in a separate variable and leave n_entries holding the count, the way tracing_map_sort_entries() does on its own error path. The stats block is only entered for a value carrying .percent or .graph, which __create_val_field() has rejected since v6.3, so this cannot be reached in mainline as it stands. It becomes reachable again with "tracing: hist: let values keep the percent and graph modifiers", so it should be applied first. Cc: stable@vger.kernel.org Fixes: abaa5258ce5e ("tracing: Add .percent suffix option to histogram valu= es") Link: https://patch.msgid.link/20260907060323.480728-1-donggeunyoo.kernel@g= mail.com Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260907053113.1CED91F00A3A@smtp.kernel= .org/ Signed-off-by: Donggeun Yoo Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 8cad99a8d01e..8d80562fb502 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5677,7 +5677,7 @@ static int print_entries(struct seq_file *m, { struct tracing_map_sort_entry **sort_entries =3D NULL; struct tracing_map *map =3D hist_data->map; - int i, j, n_entries; + int i, j, n_entries, ret; struct hist_val_stat *stats =3D NULL; u64 val; =20 @@ -5687,6 +5687,8 @@ static int print_entries(struct seq_file *m, if (n_entries < 0) return n_entries; =20 + ret =3D n_entries; + /* Calculate the max and the total for each field if needed. */ for (j =3D 0; j < hist_data->n_vals; j++) { if (!(hist_data->fields[j]->flags & @@ -5695,7 +5697,7 @@ static int print_entries(struct seq_file *m, if (!stats) { stats =3D kzalloc_objs(*stats, hist_data->n_vals); if (!stats) { - n_entries =3D -ENOMEM; + ret =3D -ENOMEM; goto out; } } @@ -5716,7 +5718,7 @@ static int print_entries(struct seq_file *m, out: tracing_map_destroy_sort_entries(sort_entries, n_entries); =20 - return n_entries; + return ret; } =20 static void hist_trigger_show(struct seq_file *m, --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 237A14AEBC7; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150581; cv=none; b=GNgUHIZ+OhO+QmssRap+1gD5FjjarBKD0+od/ZiIpsNDlS5p3NEwT50Sm0/SsA4mRhFX08xFaRB8jhfPCLTYMbXFv0lO9LF69d6SXoEnv18CkQ+cUEiv9jfLcfBhWb/H+BmYHn2RJ6s0O0Tfe1I2bMUuEuuUzUVzSMe4iTwjf8Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150581; c=relaxed/simple; bh=17r2nWJ5mCq+EFjYU2BJ5Lxcj5QjpWB7Y/ORj51hwCo=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=NRZdbK0N9wuXzHO5GlbvEdz2lTAsdzFh8GvBHa6y+p7xtehiGrZFliWnu3wZ5k1/6NxkL1XYZ0FODzxMp+uQfKKsXpgPw+A/mglap6zBkXrEVS9sOy7RJAInkPoCTeaHsjisdbKa6VZM03wJATz/uz1K1V2De39GzKrn2J+e90o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JSFKPLhk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JSFKPLhk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8FCAD1F008A1; Fri, 11 Sep 2026 18:16:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150568; bh=BWMk4V8JLtyQmWkVA48S35Mwq6afgptAi/twnA8Jxz4=; h=Date:From:To:Cc:Subject:References; b=JSFKPLhkBB0r37eFZZGUgSyuyzBa86OvECJQDaWSujNS1+gsNzYXLpKHM9nfHOvzM 3O+UyPXqW3+5ZhSWg9iQnG8nvcudctHWB+Zqrt50jr8fKX+uceKLF0IpCbTTZOIdJl tGDZ5PxeyddlEaB7MxMWZcEVoL6Uv66GzGlT2D0x9jKHvgVSTzXm5snC/92dpWFFe+ kNSqvXZ6j/0K3ZYQBMcn5zF9GiSXKeZhPVM2Gql0D3pEmKr+d+iXL04Hq2KFQjGCdH 2EQKP2rTwH8uT9z9d7OwtV/IEo7+4ZxeJ6aqVcK5sI2sZI6+7Hw8xllLBz26EzPj94 8ERuY5lWJravg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oY-000000094zU-0s6e; Fri, 11 Sep 2026 14:17:30 -0400 Message-ID: <20260911181730.028349834@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:45 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 09/20] tracing: Let histogram values keep the percent and graph modifiers References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo The .percent and .graph modifiers exist only for histogram values, but a value carrying either of them has been rejected since v6.3. The example in Documentation/trace/histogram.rst, # echo 'hist:keys=3Dprev_comm:vals=3Dhitcount.percent:nohitcount' > \ events/sched/sched_switch/trigger returns -EINVAL. parse_field() sets the two flags only when the field is neither a key nor a variable, that is, only on a value: } else if (strncmp(modifier, "percent", 7) =3D=3D 0) { if (*flags & (HIST_FIELD_FL_VAR | HIST_FIELD_FL_KEY)) goto error; *flags |=3D HIST_FIELD_FL_PERCENT; __create_val_field() then rejects a value for carrying them, so no field can reach hist_trigger_print_val(), where both are implemented. commit e0213434fe3e ("tracing: Do not let histogram values have some modifiers") added the check after a value with .buckets oopsed in hist_field_name(). That happens because .buckets and .log2 make create_hist_field() build a nested field in operands[0] which hist_field_name() then walks into. The percent and graph flags do not create an operand and are not read by hist_field_name(); they are only used when printing a value. Stop rejecting the two flags on a value. The check for variables is left alone, where they are unreachable anyway because parse_field() rejects a variable carrying them first. With the two flags removed, the trigger above installs and prints as documented: { prev_comm: rcu_preempt } hitcount (%): 0.00 { prev_comm: init } hitcount (%): 99.98 Totals: Hits: 237896 Cc: stable@vger.kernel.org Fixes: e0213434fe3e ("tracing: Do not let histogram values have some modifi= ers") Link: https://patch.msgid.link/20260907052113.430818-1-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 8d80562fb502..5e00da2d5b1a 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -4299,8 +4299,7 @@ static int __create_val_field(struct hist_trigger_dat= a *hist_data, goto err; } else { /* Value */ - if (hist_field->flags & (HIST_FIELD_FL_GRAPH | HIST_FIELD_FL_PERCENT | - HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2 | + if (hist_field->flags & (HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2 | HIST_FIELD_FL_SYM | HIST_FIELD_FL_SYM_OFFSET | HIST_FIELD_FL_SYSCALL | HIST_FIELD_FL_STACKTRACE)) goto err; --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 232514AE127 for ; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150579; cv=none; b=J1dwtZQO0zppy8UJLcCi02UQwlFWWAJ9OAFqSfGt0qUAwh8FlTRn8JXZcRgViN4rV2CDKTMvhVkCJLib5hq6e8ZjSbv8f0EZ6lgp2L5k6Izh1CdFSOPEyrBeEoPY8b4IOb99DM5+YT4swx/9SRU0Iyy5CzRqi+o5WMXhs13YFs0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150579; c=relaxed/simple; bh=Zk3FXHniipjw/+WRbl891JFRUeMJ23lamGmrr6/Uwm0=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=lcsr/IC5XoU/0J7skZw8UGwVVvaesJ6ustDBucP9JJ5HPaGJH0zjGUFzQ7vlqZJF8qWm/9qls7u8lKRbxlf2r2j3OodHkZhpLj2DbHvfQcX8I4lCEpqkHgGvu/AocuC1bg93qunYiLDO8sFupgTlWXAWiCpMhAw7tIzTm5N6lXo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SWyeMS5A; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SWyeMS5A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0EB11F008A3; Fri, 11 Sep 2026 18:16:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150568; bh=uexNQDNo7d7HNsbNZ2HKiPNKKIJxaV1+tpsEgCeUt0o=; h=Date:From:To:Cc:Subject:References; b=SWyeMS5AHZk/s8AEWmODv5LosyihSVkZn7XBk5HrayxVZU9nKbh7FAry4+H/arySU RJxDgClJgbtdCKIPwF77k2OlNKFsfid/xZ9rGyLqwPqiIS76TkbXEMKa8LaNFqxJi6 mrfm3i+5ASIMSuM9l09AttNgrqRnsHpDX9FkJEmF3s2M4v+rxkQeehHqbts6Ct589e Qr+Fs9hHFUxsMAU6qGbRAjb7vqHDyfzlCDvov9OgT4tXqvpRd+5V89BvNqFxhdLh3b KSWGCA0MV1FYrHYvFMaajy2ic3wM8kS5BREsmPctBW38qGZn/QQ9cTdqsdOYvkT6ac /dhTxvIzv9wBg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oY-00000009503-1ksN; Fri, 11 Sep 2026 14:17:30 -0400 Message-ID: <20260911181730.228443484@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:46 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Hemanth Selam Subject: [for-linus][PATCH 10/20] tracing: Fix typo "availabe" in comment References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hemanth Selam Correct "availabe" to "available", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Link: https://patch.msgid.link/20260907062608.13924-1-hemanth.selam@gmail.c= om Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Steven Rostedt --- kernel/trace/rethook.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/rethook.c b/kernel/trace/rethook.c index 5a8bdf88999a..87a27f3aa4a6 100644 --- a/kernel/trace/rethook.c +++ b/kernel/trace/rethook.c @@ -171,7 +171,7 @@ struct rethook_node *rethook_try_get(struct rethook *rh) * This expects the caller will set up a rethook on a function entry. * When the function returns, the rethook will eventually be reclaimed * or released in the rethook_recycle() with call_rcu(). - * This means the caller must be run in the RCU-availabe context. + * This means the caller must be run in the RCU-available context. */ if (unlikely(!rcu_is_watching())) return NULL; --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 236164AE131 for ; Fri, 11 Sep 2026 18:16:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150579; cv=none; b=QqAeXX30OMtMZ72WGRvGYvlW0nolLoXTOvO2N6Vr7kdRnrPBYa8l8g0mZqYxDuj1xv3W35eeL/akfLpWxHk5XAk9sj2acPZeoyY50DS9EIXAKBaf7AmdJv6wAlLdWkTeu2rteSaHWkxgE+WTVeiD4SSnob4uyZrAYhXO/i2G+dE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150579; c=relaxed/simple; bh=NrZ5b8u0NqcUgB9oWXPsc1NC/hDu7tqOIfdEUu/Ai38=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=FgRXoMxwKgeu/VXsyt/VWQsAjnDqBu5N80v4+UqPCrEiJj38VjceJdmWCJebApTLVhsVXkNmcKTNMd5c7f5XHdrChBT+kFVJyCNKGNXxDK0/68cVM9RRFQ9BFaxspgN0MvTpvgM7awqfboYdlWS4w38n6xIGFe8MgXGsBixSeAU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=kxAGRHdr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="kxAGRHdr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 430BD1F008A0; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=kQr4SbF1FOn5RnIQA+hQDigs2DAnSLpJ7VoUlffjF+U=; h=Date:From:To:Cc:Subject:References; b=kxAGRHdrjuQVwyZ+aRQd2bctP3i5IG5hdtcsrYK3iJ0X37LH0Q+Z+0wD9oJBtmM5e CQqo5Jqs0DqmeBO4tglCU5iCZrVK5Zyx1IUCQEP1ulUIA8MOac6j0xrb1pRzxP8zWh 5i7EY1sHK5SeFEIuMxEm7f0itKK9l0iOLNTYWs9XXoXPBnurCky8kGgo7xCZ3xmiYq RrDMbs4VjR3NvMIe5dWWl915ohXCxgyTXjDLv4SP3HHyd7OMbrt9HOpyM7K9kaXSbh BOVQgAwSQQhs3C5+H9FTqICTXk2yNfQUKTNZ2AzqndRe27pV45pRAJ3JFyj2yL0eqV OOOftenieFNIQ== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oY-0000000950c-2dDN; Fri, 11 Sep 2026 14:17:30 -0400 Message-ID: <20260911181730.441310379@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:47 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Hemanth Selam Subject: [for-linus][PATCH 11/20] tracing: Fix typo "preceeded" in comment References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hemanth Selam Correct "preceeded" to "Preceded", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Link: https://patch.msgid.link/20260907065607.36615-1-hemanth.selam@gmail.c= om Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Steven Rostedt --- include/trace/events/timer.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h index ca82fd62dc30..3aa0608c6361 100644 --- a/include/trace/events/timer.h +++ b/include/trace/events/timer.h @@ -302,7 +302,7 @@ DECLARE_EVENT_CLASS(hrtimer_class, * hrtimer_start_expired - Invoked when a expired timer was started * @hrtimer: pointer to struct hrtimer * - * Preceeded by a hrtimer_start tracepoint. + * Preceded by a hrtimer_start tracepoint. */ DEFINE_EVENT(hrtimer_class, hrtimer_start_expired, =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4968B49BD99; Fri, 11 Sep 2026 18:16:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150582; cv=none; b=NnZOqJFl94aN7r3BP/6T2jQEe1+XjtKnitretgInstMZUkM646GNf7nDhFjxWaerjrYmyo7ThPXsY+Pw6/7yeV21apit+sJMAFvdWnAe7+SKJ9NH1FUF3jNe342zNIO1kNJdIEM1+HBjymuzK54fq+6Igkq7As8c4+3LBMT/0M0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150582; c=relaxed/simple; bh=l7RMM3fOQcT67m9QVDy7NEUN0usrujTmJJ/b4bmuubA=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=tMAafGgLgp6heW4JS66JJA2YkXwWJV0eQ9E8ou3+1XfYaqnPkJfOp7MInCp7Yq7KJDyQDxpHHAH23KMWCTk2fse4cz729DfBehJ0PJv0yFOs3s3zE8jX6gUlyb8GuIVXyIv/Pf1qZOeaAE6cnWTSdYDptZzlzkhz3rTFuHGU3GQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bYBCW8St; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bYBCW8St" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3A8EA1F0089F; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=S0PII1y871JaHgR+bTBT4HW+/nC8mLPVa1/mhADxMxw=; h=Date:From:To:Cc:Subject:References; b=bYBCW8StGrvvtk4Z3GLT96eUDoomVYMvPN1NN22tQksUBXvFzlcCKk578Io1ksea8 MOnnj5mSx9NPqvqDzdx7Sb3bbJHYf0HKpWFoMHtPhX4XjNoNR6+MuVC6kAnATG3k+6 NFkth5q89iQWFz4d4B9LIyAKMlrbOFyewVWllPncPY8UK/B7lBJZc+J5QyrJ8yRNkx aGdzyzc+peciPhU2G8sUmjLrUeHR6a3lb+RAHjXrInzhvGlCSxsj8oGUW/PazsvnAN UeSs4johIOLuKAURpLxmBQ8zzlDozVX4n4FqX+G89q3XwKw8ZLaLP3gAmFzv381zRM 0fgYZAZaiQNlw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oY-0000000951B-3R9D; Fri, 11 Sep 2026 14:17:30 -0400 Message-ID: <20260911181730.645121642@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:48 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 12/20] tracing: Set the trace clock before registering the histogram trigger References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo hist_register_trigger() puts the trigger on the global named_triggers list in cmd_ops->init(), and only then sets the trace clock: if (data->cmd_ops->init) { ret =3D data->cmd_ops->init(data); if (ret < 0) goto out; } if (hist_data->enable_timestamps) { ret =3D tracing_set_clock(file->tr, hist_data->attrs->clock); if (ret) { hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock)); goto out; } The clock string is not checked anywhere before that call, so a named trigger using common_timestamp with an unknown clock fails after it has already become findable. event_hist_trigger_parse() then frees it without taking it off the list, and the next lookup by name reads the freed object: ~# cd /sys/kernel/tracing/events/sched/sched_switch ~# echo 'hist:name=3Dfoo:keys=3Dcommon_pid:ts=3Dcommon_timestamp:clock=3Db= ogus' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=3Dfoo:keys=3Dcommon_pid' > trigger BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff88800915d760 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0x900 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 63: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Set the clock before the trigger is registered, so that nothing which can fail runs after it is published, the way commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") moved the registration below the rest of the setup. tracing_set_filter_buffering() is reference counted, so the init failure path has to drop the reference that the clock block now takes first. Cc: stable@vger.kernel.org Fixes: a4072fe85ba3 ("tracing: Add a clock attribute for hist triggers") Link: https://patch.msgid.link/20260907091415.554535-1-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 5e00da2d5b1a..1889e310b73c 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6631,12 +6631,6 @@ static int hist_register_trigger(char *glob, data->cmd_ops =3D cmd_ops; } =20 - if (data->cmd_ops->init) { - ret =3D data->cmd_ops->init(data); - if (ret < 0) - goto out; - } - if (hist_data->enable_timestamps) { char *clock =3D hist_data->attrs->clock; =20 @@ -6649,6 +6643,15 @@ static int hist_register_trigger(char *glob, tracing_set_filter_buffering(file->tr, true); } =20 + if (data->cmd_ops->init) { + ret =3D data->cmd_ops->init(data); + if (ret < 0) { + if (hist_data->enable_timestamps) + tracing_set_filter_buffering(file->tr, false); + goto out; + } + } + if (named_data) { remove_hist_vars(hist_data); destroy_hist_data(hist_data); --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 747504B1473; Fri, 11 Sep 2026 18:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150586; cv=none; b=gYRijB58Dzc5n+yE5dpd2I7ePrvOoWT5wUZo2xavBrSUH/jrceU+EIcjntr68jzhZpxrsJFkWM+b2xlLaaMuY5PC5PsQ+3D2gjctDpQ/kqrRwDV1rR4dCSP9bEA86+KrbTu3fz3imF3i49vtHzec/J0ZkR66D77XkAKF0jZfHrU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150586; c=relaxed/simple; bh=h8jc8CfPjqwE/cE4ogLFRAF/HxsukaCJ//a5gqGd0yA=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=OCzGklnJomK1LarrdeHPtazz/Cd0OEaZbRJcmv/is3X6I7aX/+9rWKb+un2OD2G8beiTNIvdlYp/72Q9waGALy4Vryk6HN1Ej3t/YeiE75zMhVENNxRjA8ewW83UTmd0UXWrGhpQV/wBh9vtZ+uU/UftljPg4W0rS5mDwhXqYig= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=j2UPb9g3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="j2UPb9g3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 530151F008A4; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=QTuelLlM14RAKfKiCxcUFQNPREEn8bUD3IeV7jrQiac=; h=Date:From:To:Cc:Subject:References; b=j2UPb9g3mFQToQL8uml34DwAw2Rx9fdESnoVao/Be4jpVFu7YnnxylQV0aWkzFb1/ QCtc6KaawqZAoCP6CqwziqUEHlCq5MmfrSMh2utue1lOrxiXiGVffH6LHlDepPkEMP 2GyonIoNFgbKIa6mOGbsckMT9C1KWmuoDT+wkMyHu0VdP5vrGZXcKCC25DqaXpwHss zymUQjZcn1W8g5go+2PjFzNvhkbWn3JhJ03ywnm0GRl53OCwkOXsa3zyOVTMCP78rS 7UL6VhjmefURempxBXrPZRXj3zvrdt6QftELGc/qbYOzkgXnnX7l+z6PdACNzGmDox Ir6bzBvhBtK+w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000951k-03aK; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181730.835279329@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:49 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Sashiko AI , Donggeun Yoo , Tom Zanussi Subject: [for-linus][PATCH 13/20] tracing: Take the reference before publishing the named histogram trigger References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo event_hist_trigger_named_init() puts the trigger on the global named_triggers list and only then takes the reference on the trigger it shares its histogram with: data->ref++; save_named_trigger(data->named_data->name, data); ret =3D event_hist_trigger_init(data->named_data); if (ret < 0) { kfree(data->cmd_ops); data->cmd_ops =3D &trigger_hist_cmd; } return ret; event_hist_trigger_init() fails when alloc_hist_pad() cannot allocate, and nothing takes the trigger back off the list on the way out. event_hist_trigger_parse() frees it, and the next lookup by name reads the freed object: BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff888009346860 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 67: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Do the reference first and publish once it has succeeded, so that nothing which can fail runs after the trigger becomes findable. Cc: stable@vger.kernel.org Fixes: 7ab0fc61ce73 ("tracing: Move histogram trigger variables from stack = to per CPU structure") Reported-by: Sashiko AI Closes: https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00= A3D@smtp.kernel.org/ Link: https://patch.msgid.link/20260907124420.607097-2-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Acked-by: Tom Zanussi Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 1889e310b73c..54c95f9bd0a3 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6371,17 +6371,18 @@ static int event_hist_trigger_named_init(struct eve= nt_trigger_data *data) { int ret; =20 - data->ref++; - - save_named_trigger(data->named_data->name, data); - ret =3D event_hist_trigger_init(data->named_data); if (ret < 0) { kfree(data->cmd_ops); data->cmd_ops =3D &trigger_hist_cmd; + return ret; } =20 - return ret; + data->ref++; + + save_named_trigger(data->named_data->name, data); + + return 0; } =20 static void event_hist_trigger_named_free(struct event_trigger_data *data) --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF15A4AE8A3; Fri, 11 Sep 2026 18:16:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; cv=none; b=I7771bbFSXIwDlccANj8tEEUpW7WqXBIBaLQpFipLFwuWS+KgSqrbKkAYtqYga4m9+v2yT8ZLQGa/pebaBdLQqtQiDesXME/mj6DBXbOs1I9DlfUq6M51TuACB3P7la6GLZZmiNNvcEuhxFZ6DTNJCS9yyvdWsZKu/WedvkuQVc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; c=relaxed/simple; bh=iF59T3YjQGHBTphMKe4Fg1DQczI1qQmP93+B0CkHnRI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=iawJVEnDd8DH/pDLoxmUfnZI6jK/n21TRVMZh8Ks+tLGBd/DZhaX+MjaKOpDoP/le6rox7gWNw64NO4Y834Q6UoFkHcAHeFyIcVTaEOw9ewsAi9/CHFH+Rc26LRm/FE+aBpiL89Cr5nWOQs0K9dWNUNcsBN0GMZheqS+6A0k1f8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hpgELrEc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hpgELrEc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 840D61F008A7; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=R/jXZIQARBzsMkIBoNev/vP32ap2egEbi4518A6m4T0=; h=Date:From:To:Cc:Subject:References; b=hpgELrEckIb0uxykc6T/dx0W9mNuQK3F5nt6OwgrmdQDRvLzdJvFFHJrtdNm7+aCW wb81raGNprGP5sSr1HfPTnpb+H7IpyRT8cfxBdnGOycM+6n+iKJU1V8xD9EZlo5dcw VdIlcDub6sj91TFoIICRn8RrfIsTGhbGD8hUhUfPeXJXKIKI1BuQqPNeyjuDTViQi8 HzW86Gx1rJgG0yNGDQ+c4MkPc5gMVloRdEklj90ebJvDhSaAzhKduRKTwpTWfhWicY qcHvDmaC4bHdVgNpQRNCTVH0odzLQSz62DoI41ZT+L1abmHjtfOMpbe9df517a/hrO DcZfruwmR8YWg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000952J-0sav; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181731.034282245@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:50 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Sashiko AI , Donggeun Yoo Subject: [for-linus][PATCH 14/20] tracing: Undo the registration when enabling the histogram trigger fails References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo Commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") described how a trigger that is registered but not on file->triggers ends up freed while still on the global named_triggers list, and moved the registration down so that hist_trigger_enable() follows it immediately. One path still gets there. hist_trigger_enable() adds the trigger and takes it straight back out when the event cannot be enabled: list_add_tail_rcu(&data->list, &file->triggers); update_cond_flag(file); if (trace_event_trigger_enable_disable(file, 1) < 0) { list_del_rcu(&data->list); update_cond_flag(file); ret--; } so the list walk in hist_unregister_trigger() matches nothing, test stays NULL, and the ->free() that would call del_named_trigger() is skipped. out_unreg falls through to out_free, which frees the trigger anyway: BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff8880091d3160 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0xa00 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 69: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Leave the trigger where hist_unregister_trigger() can find it and let that undo the registration, which is the only code that knows all of what cmd_ops->init() took: the named list entry, the hist_pad reference, the reference on the trigger a named histogram is shared with, and the copied cmd_ops. It also pairs the failed trace_event_trigger_enable_disable(), whose sm_ref and buffered event reference are otherwise left behind. Since ->free() releases trigger_data and, for a trigger that does not share its histogram, hist_data with it, out_unreg can no longer fall through to out_free. For a trigger that does share, hist_register_trigger() has already destroyed the caller's hist_data, so the fall-through was reading freed memory there as well. Move the enable_timestamps check in hist_unregister_trigger() above the ->free() call for the same reason: hist_data does not outlive it once the trigger being removed is the one that owns it. Cc: stable@vger.kernel.org Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist trig= gers") Reported-by: Sashiko AI Closes: https://lore.kernel.org/linux-trace-kernel/20260907092944.3950E1F00= A3D@smtp.kernel.org/ Link: https://patch.msgid.link/20260907124420.607097-3-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 54c95f9bd0a3..53100287466f 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6670,11 +6670,12 @@ static int hist_trigger_enable(struct event_trigger= _data *data, =20 update_cond_flag(file); =20 - if (trace_event_trigger_enable_disable(file, 1) < 0) { - list_del_rcu(&data->list); - update_cond_flag(file); + /* + * On failure the caller undoes the registration, and + * hist_unregister_trigger() can only find the trigger here. + */ + if (trace_event_trigger_enable_disable(file, 1) < 0) ret--; - } =20 return ret; } @@ -6752,13 +6753,13 @@ static void hist_unregister_trigger(char *glob, } } =20 - if (test && test->cmd_ops->free) - test->cmd_ops->free(test); - if (hist_data->enable_timestamps) { if (!hist_data->remove || test) tracing_set_filter_buffering(file->tr, false); } + + if (test && test->cmd_ops->free) + test->cmd_ops->free(test); } =20 static bool hist_file_check_refs(struct trace_event_file *file) @@ -6963,6 +6964,8 @@ static int event_hist_trigger_parse(struct event_comm= and *cmd_ops, return ret; out_unreg: event_trigger_unregister(cmd_ops, file, glob+1, trigger_data); + /* The unregister frees trigger_data, skip out_free */ + goto out; out_free: remove_hist_vars(hist_data); =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF2824AEBD2; Fri, 11 Sep 2026 18:16:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150582; cv=none; b=lYHeIPmKuEQGCbXHsoYLTUZqa0VUR97ML9PGBXoBU91SfW4ayLf6ki3gJ/8s1xgiwtzEB7CQgUnYzZXrNLRz4EcFX+99OZ1WuH59MLYkzSjdxI+fvrKV3n2oyU5OQwRduuLE5xwFbUErbzFEqfDe1QiHOatotkYXWBgxf3AKPeQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150582; c=relaxed/simple; bh=aiVuaL+HgNp0r2a97wYVR7TIRvdnMSxMm6JtjK7wbT4=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=W8AS934NMtMXcFEEGnD7qU4I+jSMD8LWziwFlY/HjuedF80oazDlqHtuCIqaee3BY7ouZOM9eODHhuetNOhkAEuJuKH69ZO/DPwE2obgzm3Pq29I7LOFNspCdRrErMC6HHEBmXaw43PaGsFCL2EMMkk4lEm6I1WJr7+LGiQilcA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=imLfF9Yb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="imLfF9Yb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE5191F008A6; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=+c6xAc6jgMcoYsD9ivY2w9mrMh0m+dPswg0amAK3TPU=; h=Date:From:To:Cc:Subject:References; b=imLfF9YbZk21A077IrHBc21/Jh9rQpm9hcxoHSv32ali9wa7V13sUq5ivsRQoPpFu 7Y9Y5nac3KvxW8d+kKqTeN9+qgar1A6bkHC1VoPsje1h7rtjIx2B2R7keZqnY0Z9GS oGbkSALe2RI6OAeaUE6Qg8R5yrvffEd9/0Ku2mdnIRCsXeNHdmC3gekqDm2Egm0QRp FF3ZSh95IQUzay4IEHD73oe/8N0FIiHQJgSu3hwAlv7DYqrrb52mal66yxGBUqnoen hK6u9dL9OWDhTUUIlhTQaJFLPV1zq0b01y6xM3AO5PbvBynjMrt6vqPqR0Q5klz+Kx +m0YF2og0fd6w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000952s-1hZ9; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181731.228624014@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:51 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 15/20] tracing: Fix memory corruption from the histogram stacktrace modifier References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo parse_field() sets HIST_FIELD_FL_STACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved to a field which holds a stacktrace. create_hist_field() picks HIST_FIELD_FN_STACK on the strength of the field pointer alone, which reads a __data_loc word from the record and follows its low 16 bits as an offset into the same record. event_hist_trigger() takes the first word there as an entry count and copies that many longs into a 31 entry array: n_entries =3D *stack; memcpy(entries, ++stack, n_entries * sizeof(unsigned long)); Neither end of that copy is bounded, and the count is whatever the event holds at the offset, so any field will do: # cd /sys/kernel/tracing/events/sched/sched_process_fork # echo 'hist:keys=3Dparent_pid.stacktrace' > trigger # (true) BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: 0010:rb_insert_color+0x18/0x130 timerqueue_linked_add+0x7e/0xd0 enqueue_hrtimer+0x39/0xb0 __hrtimer_run_queues+0x10f/0x1f0 RIP: 0010:memcpy+0xc/0x30 event_hist_trigger+0x165/0x690 The timer interrupt landed on the rbtree the copy had already run over. No debug options are needed for this; KASAN reports the same write as an out-of-bounds read of 13835058055416381440 bytes. Documentation/trace/histogram.rst already states the rule, "must be a long[] type", so enforce it once the name has been resolved. Names which resolve to no field at all, "hitcount.stacktrace" and the common_* pseudo-fields, are refused for the same reason: they hold no stacktrace to read. Cc: stable@vger.kernel.org Fixes: cc5fc8bfc961 ("tracing/histogram: Add stacktrace type") Link: https://patch.msgid.link/20260907155045.692664-2-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 53100287466f..9bc829c1e876 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2317,6 +2317,7 @@ parse_field(struct hist_trigger_data *hist_data, stru= ct trace_event_file *file, struct ftrace_event_field *field =3D NULL; char *field_name, *modifier, *str; struct trace_array *tr =3D file->tr; + bool stack_modifier =3D false; =20 modifier =3D str =3D kstrdup(field_str, GFP_KERNEL); if (!modifier) @@ -2339,9 +2340,10 @@ parse_field(struct hist_trigger_data *hist_data, str= uct trace_event_file *file, *flags |=3D HIST_FIELD_FL_EXECNAME; else if (strcmp(modifier, "syscall") =3D=3D 0) *flags |=3D HIST_FIELD_FL_SYSCALL; - else if (strcmp(modifier, "stacktrace") =3D=3D 0) + else if (strcmp(modifier, "stacktrace") =3D=3D 0) { *flags |=3D HIST_FIELD_FL_STACKTRACE; - else if (strcmp(modifier, "log2") =3D=3D 0) + stack_modifier =3D true; + } else if (strcmp(modifier, "log2") =3D=3D 0) *flags |=3D HIST_FIELD_FL_LOG2; else if (strcmp(modifier, "usecs") =3D=3D 0) *flags |=3D HIST_FIELD_FL_TIMESTAMP_USECS; @@ -2412,6 +2414,12 @@ parse_field(struct hist_trigger_data *hist_data, str= uct trace_event_file *file, } } } + + if (stack_modifier && + (!field || field->filter_type !=3D FILTER_STACKTRACE)) { + hist_err(tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str)); + field =3D ERR_PTR(-EINVAL); + } out: kfree(str); =20 --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 420A04AF149; Fri, 11 Sep 2026 18:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150587; cv=none; b=niTHflyrRlLV8K1iyE8tFMxv2MMqaWLKJqx9FgaFEXVdmagvC6iRobu0d98guLI5en8AUzH+lpzLv2hTj1SrFejm6z8Nz2OS6bGmJE6RKs2Flt7CV2XNQo3PC2JI8FaCDuaS770QCg2e1bEvqPkBqKXzte84Py1ZLx2/7oI+Cqc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150587; c=relaxed/simple; bh=qpgQMbI319t5JAx84XjVZXwQAy/SR0qzr4NEOs8NxXc=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=sCL3iDwodyIEaSqvkUYhUh9eq3fQaTi854OW+ss5LD8FBURrLsG7GEgSWQw1s/taEQJVGhaVdMu2Yn49zDPsRzsxTxFJCY7oulSEqJXRsNp5Sag8mfkXF2d4LGgfUxJAoZ43vi9MSwvSBe7ZViFMhxZ5X4nTJt7cQSvo9rY141s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XFBzDTL9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XFBzDTL9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6E7C1F008A2; Fri, 11 Sep 2026 18:16:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150569; bh=seZXANT79DbnVtGgHNwdlFiY9xg5fwxpTHirr7vIpRU=; h=Date:From:To:Cc:Subject:References; b=XFBzDTL9LiO7GVpAIeAWd4uYn51A3oS7KrPNu64E9QnmQ1QBpAd1Ng+ApTKtD3v1s 3iGws0s12oZiExcA4P1gfbqAjcFI1yCR0s3SsiCBJUZVvZwpbpvbQwHSJdhTRCbcZ4 ifi7FXFkNaIn/FQt1WeUufe6nfthKQGr8E3LjLbPvK1025Ccq9wlh6lvF+aO7f9INS Z0wBIR+WUVDUSMFP51mqzHL4QM5c4DIN8ANEOg/B8ZpXs1cwxOtgt8JMJoWDc65EGO 8aS6hpC3Db+uE3PQObfoJbg447J7O6RptOVpb+gKKbboagXVi6FTB7Sgw9xMkvXJTm hO8Aol2wTEDvA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000953Q-2W2w; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181731.424682594@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:52 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Donggeun Yoo Subject: [for-linus][PATCH 16/20] tracing: Fix memory corruption from a "STACKTRACE" histogram key References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Donggeun Yoo "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parse_field() maps them onto their common_* equivalents for backward compatibility, but unlike the common_* names it hands the placeholder back to the caller instead of NULL. create_hist_field() takes a non-NULL field as a promise that the record carries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc word is read from offset 0, that is from common_type, and its low 16 bits are followed as an offset into the record. What is found there becomes the length of an unbounded memcpy. Pick an event whose id is small enough that the offset stays inside its own record and the length is a kernel text address: # cd /sys/kernel/tracing # echo 'hist:keys=3DSTACKTRACE' > events/ftrace/print/trigger # echo hello > trace_marker Oops: general protection fault, probably for non-canonical address RIP: 0010:rb_next+0x23/0x60 RIP: 0010:memcpy+0xc/0x30 event_hist_trigger+0x2e7/0x12c0 Kernel panic - not syncing: Fatal exception in interrupt Leave the field NULL, which is what the comment above the branch says the code does and what common_stacktrace already does. FILTER_CPU and FILTER_COMM are left alone, their create_hist_field() branches never look at the field. Cc: stable@vger.kernel.org Fixes: 4b512860bdbd ("tracing: Rename stacktrace field to common_stacktrace= ") Link: https://patch.msgid.link/20260907155045.692664-3-donggeunyoo.kernel@g= mail.com Signed-off-by: Donggeun Yoo Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 9bc829c1e876..8af97fd4ee2d 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2404,6 +2404,7 @@ parse_field(struct hist_trigger_data *hist_data, stru= ct trace_event_file *file, *flags |=3D HIST_FIELD_FL_CPU; } else if (field && field->filter_type =3D=3D FILTER_STACKTRACE) { *flags |=3D HIST_FIELD_FL_STACKTRACE; + field =3D NULL; } else if (field && field->filter_type =3D=3D FILTER_COMM) { *flags |=3D HIST_FIELD_FL_COMM | HIST_FIELD_FL_STRING; } else { --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41F864AEBED; Fri, 11 Sep 2026 18:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150585; cv=none; b=IhCc7irqKFhmurx4Q+kePt/ZfkcrcZqqCCf4FvPU91ZbP8XO3xU7Fl2pPSx1jg9ZLt8B7TuShaJ2+vbn1vraI4Wxd9MWOwozNvKW1HxKwfbR/hKS3SbuUlC7MkpHn1rYnnwgj/amz+J0W1xzyw6Bq6EZ4P40rF77bkT5y89JMsY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150585; c=relaxed/simple; bh=dSqrCsSrWDUPxNHTVfEw2JBtCVtC4NBP/J8WxSf77w4=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=njjfmUWC/bPN+Ok/yuqOzj8pe72TohJFcmVnayxnlwORCPRs7almBFcpKj7LOHAkXAmEOxNCsjQAgrlV48K07W/JGeT/L+8ZOZvQ3YCwSPGrxVCaiMYxqJvI3x1wUbjrtfIERBsyz9rqcvy6S1hsgyWEt/rMNByYpDsVlrBVVUA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DO4rtOc3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DO4rtOc3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2A2CB1F008A5; Fri, 11 Sep 2026 18:16:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150570; bh=e1kVkCGH9uMPrZue3dk1oxAWADU5bWLWikEXk+pClBQ=; h=Date:From:To:Cc:Subject:References; b=DO4rtOc38OZpZpKbvQvrOiJRe1hJvFfrybNc4BU+VlPJmQL9ZNSQrel8vOEBaKxea KbQRLU9xUsHekZzbJcAqxuAg2/7RJlrzVydynVWhSQsasjfGyIBve0CjhF3UqMLVRZ D6u5HsM9bKAuahnzUJa6TXOkewwIAH6AoA/NNRZdjDq2DgBmrQTUnZKxzAUAV0q1vX oCSDrja+RRVCmUD7HtRcjia782ac3gXNqx5I+2/P8hr5rERhA7DV7p+gnOHgxSzD45 5YWK9kszSOEDK6WxiQLrj5Tvp49/gJEGUciLyuCTiMhydQD1+01iwz4INi/M2Nwn+s iHOSzFEJReonw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000953z-3Knn; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181731.617157375@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:53 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= Subject: [for-linus][PATCH 17/20] tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: =3D?UTF-8?q?Thomas=3D20Wei=3DC3=3D9Fschuh?=3D While ftrace_set_clr_event() modifies its input buffer during parsing, before returning to the caller the buffer is supposed to be restored to its original state. This works correctly for the colon between the subsystem and event but not the colon at the beginning of :mod:. Restore the colon, so the :mod: trailer is not stripped after ftrace_set_clr_event(). Cc: stable@vger.kernel.org Fixes: 4c86bc531e60 ("tracing: Add :mod: command to enabled module events") Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-1-05396= a3fb663@linutronix.de Signed-off-by: Thomas Wei=C3=9Fschuh Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9dbc2441763b..30c0ddf90887 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1489,6 +1489,8 @@ int ftrace_set_clr_event(struct trace_array *tr, char= *buf, int set) /* Put back the colon to allow this to be called again */ if (buf) *(buf - 1) =3D ':'; + if (mod) + *(mod - 5) =3D ':'; =20 return ret; } --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E0194AEBFC for ; Fri, 11 Sep 2026 18:16:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; cv=none; b=UVezQn4FqPCwbzhelk64IdgkLa/PO6C+TjEnjwTy9eprx/yFTMtWF5hgaDzg+FLGOgZwHRhQz8wmtbkyd/r9WeWUBnKT0bLz+Fz1tR6KPj3I+I3d4SFrCZaHpln0MbWrhrcgeQvhCYR2TVBA7bi8TZEgz/13tnTFfjW1nRQ3KfM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; c=relaxed/simple; bh=7ro2pE3u1riMhANQCJdihA9BGA1wIj4E7MHaErE/2kI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=V/lOHTn872aitovB8v4j17hiL9aUxe+JBIOSYd/6QoxnCHdd55lPgtKGw2I9xEJBU1Epkpk3iMPqUxYuRgZMDC20K2VtwaV3Yy/OX8txpjXFX+ZKdDJCPFZmFNy7NWdMRUGmMAqbX7q4GQzPaVbZBDaQXmqJ++RLvEnL9Boo9EQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LWiM2aBh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LWiM2aBh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C0491F008AB; Fri, 11 Sep 2026 18:16:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150570; bh=LhELnr2rFNek0pOOslIV9nnQKN7vIKo6BwdAORpnRjg=; h=Date:From:To:Cc:Subject:References; b=LWiM2aBh6hZ9lG4jFEnBhvZsAuq+L3rwhKTHTIDNold916Yl2XCCdCij7UdzqZzok F1xpyP0/HILFrkcY5f3p3CfvKFMNSQbl72pavrUxK3y31KtzLxhGHMxuVKV3EkOopu GnqkDILnEnceq7zaNY27Kgy3RSLZHsF0tKG2d+vtJ91E/QH5kXwH5qxtbBf2+okhHE o3Jb5pC8cQg/+60FpnWXYl2QR3widaRbehlYye1tL3FLCDqW7Wwb53gS4mrGrLoft8 KbNoOss9/wTBEKyHcNqYjeqfyJFleKekHMqsvnFezF79EROEHhdhRe4nGFiC/p8cLx bzsygn6f0Jglg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oZ-0000000954Z-4906; Fri, 11 Sep 2026 14:17:31 -0400 Message-ID: <20260911181731.813962582@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:54 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Karl Mehltretter , Vincent Donnefort Subject: [for-linus][PATCH 18/20] tracing: Fix ring_buffer_read_page_size() kernel-doc References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Karl Mehltretter ring_buffer_read_page_size() takes a parameter named rpage, but its kernel-doc describes page. As a result, kernel-doc reports rpage as undescribed and page as an excess parameter description. Rename the documentation entry to match the function. Link: https://patch.msgid.link/20260909062917.89482-1-kmehltretter@gmail.com Fixes: dae8dda341d2 ("tracing: Fix subbuf resize races with trace_pipe_raw = readers") Assisted-by: LLM Signed-off-by: Karl Mehltretter Reviewed-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 9c03a555a6ba..0e30c7bd6045 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -7384,7 +7384,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_read_page_data); =20 /** * ring_buffer_read_page_size - get size of the read page. - * @page: the page to get the size from + * @rpage: the page to get the size from * * Returns size of the page in bytes. */ --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E1F3B4AA03B; Fri, 11 Sep 2026 18:16:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150588; cv=none; b=VUAs1DMEXYbCgEynD2Nq3NeyQMV36gHIm3zGiflehnI/MnvIwoaBlm5HPXRukDsyrWi/nPjQWkxgl93p+bltMTPx3kz7EaQFQRnoGhbpCNJzN3MH4O4uG786s3mfBYyYfr7ReAqCQ4EHpON1CKrIAXfxr07XZkP0XbFH+a25YZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150588; c=relaxed/simple; bh=anlAKepp4fSdNG7SD2sOTuQwCceYwsBCXVYke80uHEM=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=BqU+PpUaRFgZqmPK0nNaWA3IrELmww0tLh4stFZ4KMNz+Sa2ZLBnbmCIcV0sNWcYdRgUQ+8pkYd1K7gTjsONWoo6ts3BFsnC1Ut0C2/hQWBHZe9+ja392aVGiD1OOmWyF1UtGoMqiHp3ppsMPMWo6XrdUleirqLDHuAgUA594Js= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SiSt0zlN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SiSt0zlN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 85C151F008BD; Fri, 11 Sep 2026 18:16:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150570; bh=Hx32kxBwKawH5WJ5tu/bUMoedLuSmLDuz6rlCV8xvSU=; h=Date:From:To:Cc:Subject:References; b=SiSt0zlNAIZ9hbj8i+vYvV9qX00CcDE20nLVxX9nLSgnwM2jJZBWfdjmKhmKEclcp CC27C5TkMauKCrWufGcEXYNnQHfTLBCgi0+W4MrcUiBLID+cxTSKzR/Do1Ps8S87X/ zjBn2JQ20VRS/OLGE4hgnCq2L14TFFXyQ0uAh0Ze6kw2iLKMVF+npBiXcFAcQuWiVK 2VM6hlS14E7RW6GJOTPSv2Uol5kgWOEDTJZL02D4snL33nZdrLakYEPofHc85d6xIF peegb+fWS5pCoYf1VTY9Iw5rrpofIOy9ktJ9Ql1/C4nICQKGK4o5QHcIVwpjbed9VY kgMXzJFxb7Xwg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oa-00000009558-0rl4; Fri, 11 Sep 2026 14:17:32 -0400 Message-ID: <20260911181732.007790558@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:55 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, sashiko-bot@kernel.org Subject: [for-linus][PATCH 19/20] tracing: Take trace_array reference when opening a tracer options file References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened. Unfortunately, there's a race condition where the element itself could be freed by the removal of the instance the trace_array represents causing a use-after-free as this element that is used to find the trace_array to increment its reference counter is also freed when the instance is removed. To solve this, add a trace_array_tracer_options_get() helper function that will take the address of the element that is passed to the open function by the inode->i_private pointer and search all the trace_arrays under a lock to find the one that the element's address is in the range of the trace_arrays topts array elements. When a match happens, that trace_array's reference would be increased. Note, there's a race where if an admin was deleting and creating trace instances at the same time and the memory of the old trace_array's array matched the memory of the new trace_array that it could in theory open the option from the wrong trace array. But we do not care because it would be stupid to perform that kind of action. As long as the only thing that can happen is that the option from the wrong trace array is used and doesn't crash the kernel it will only make the user confused. But if they are doing something stupid like this, they are already confused, so no harm done. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260910221209.62dad8d3@robin Fixes: 7e2cfbd2d3c86 ("tracing: Have option files inc the trace array ref c= ount") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260902121918.5a9e9d1b@= gandalf.local.home/ Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 46 +++++++++++++++++++++++++++++++++++++++++++- kernel/trace/trace.h | 1 + 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 8658cad53cb5..e4a490d3d08c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -7717,12 +7717,55 @@ trace_options_write(struct file *filp, const char _= _user *ubuf, size_t cnt, return cnt; } =20 +static bool tr_option_match(struct trace_array *tr, void *topt) +{ + for (int i =3D 0; i < tr->nr_topts; i++) { + struct trace_options *tr_topts =3D &tr->topts[i]; + + if (topt >=3D (void *)&tr_topts->topts[0] && + topt < (void *)&tr_topts->topts[tr_topts->nr_topts]) + return true; + } + return false; +} + +/* + * The topt is the address of a trace_array->topts[] element that holds the + * the tracer options descriptor. But since the trace_array reference has = not + * been taken yet, it cannot be dereferenced as it could have been freed by + * a rmdir of the instance the trace_array represents. + * + * Search the list of trace_arrays and compare the topt to the address of + * the entire trace_array topts array for each trace_array in the list. + * If one is matched, then take the reference and return it. If not, the + * trace_array no longer exits. + */ +static int trace_array_tracer_options_get(void *topt) +{ + struct trace_array *tr; + int ret; + + ret =3D security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + if (tracing_disabled) + return -ENODEV; + + guard(mutex)(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_option_match(tr, topt)) + return __trace_array_get(tr); + } + return -ENODEV; +} + static int tracing_open_options(struct inode *inode, struct file *filp) { struct trace_option_dentry *topt =3D inode->i_private; int ret; =20 - ret =3D tracing_check_open_get_tr(topt->tr); + ret =3D trace_array_tracer_options_get(topt); if (ret) return ret; =20 @@ -7984,6 +8027,7 @@ create_trace_option_files(struct trace_array *tr, str= uct tracer *tracer, tr->topts =3D tr_topts; tr->topts[tr->nr_topts].tracer =3D tracer; tr->topts[tr->nr_topts].topts =3D topts; + tr->topts[tr->nr_topts].nr_topts =3D cnt; tr->nr_topts++; =20 for (cnt =3D 0; opts[cnt].name; cnt++) { diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 5e76f94e7a80..bd3c8f80300f 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -227,6 +227,7 @@ struct array_buffer { struct trace_options { struct tracer *tracer; struct trace_option_dentry *topts; + int nr_topts; }; =20 struct trace_pid_list *trace_pid_list_alloc(void); --=20 2.53.0 From nobody Fri Sep 25 13:53:50 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E7114AF168; Fri, 11 Sep 2026 18:16:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; cv=none; b=O8mqv3flSk9bZ6cALKdGAiM7wXnCmbROgnxHtwdN0TQ7av3WWJw6Ic7ioIVK3zOM8fpgX0Gd7cDSb5HrbCvztut9zNQNYmXrlhfSo9MDFEfVM/wdn7Meh+63bXV+dICKgcW55m6V3/q3855Nrl8JQ8Hhzq31VjpaEv0oipWCf38= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789150583; c=relaxed/simple; bh=ZNK7lfuT09qSARdbt1/cZs7gniyWCRs5j7azukBwUOg=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=gMh4tX8leXC/cZl+2SS71r/lnFJnKHs7CF2hWdvjaViVFXX9BCE2L/1gZ2WpWArl5AfUDaPtCUzQeWZ6tyW0+hTGmwaq0tm6bZmHCdZiuXdA2ktIJNiO2H42YiXC4u7UG5euB1lkwc52M4mWkr7NevaIDJC0mfsSxY2RCGx7Dt8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=b1hkwYvr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="b1hkwYvr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CFDCE1F008BC; Fri, 11 Sep 2026 18:16:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789150570; bh=BW1arZP/jeW3t4WrRP5pr3VhcnT2T+SZnRTRC8idGJU=; h=Date:From:To:Cc:Subject:References; b=b1hkwYvrOmimg5y9V1j7so/Lrw/XPUACCW4TWvX9q2Z8X8Xo3B6MuUTi55Ah+HbGZ Pn/ExFu9U6tBSd+tPqY28cxJMy7JmHSHNijc/3c2zG0iDT7HaaMnZuXmzxdViaYSef spq6mZ3CIG3cbpIFR/o4rDzObTkv0nkr3i1Lk758rd3h8XE7VjQ7sK93rd149RE1B7 bY+esHnR1/d3TCWMZ+sOtaQBCZJMdpCLIj9F5gcNa8na+I2018fSPEywLm22ECiLNb op+GvTNdvTuxstafSwtdaj8WfAnBn1bZi8fDeP5Z+//idLNmz4HCflcI5qLrleTm6U V490Hv268vN/w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x55oa-0000000955h-1lP9; Fri, 11 Sep 2026 14:17:32 -0400 Message-ID: <20260911181732.227965353@kernel.org> User-Agent: quilt/0.69 Date: Fri, 11 Sep 2026 14:16:56 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Vincent Donnefort , Sebastian Andrzej Siewior Subject: [for-linus][PATCH 20/20] ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() References: <20260911181636.485043797@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Sebastian Andrzej Siewior rb_wake_up_waiters() is a irq_work callback which is initialized with init_irq_work(). As such it will be invoked in thread context on PREEMPT_RT. Invoking the callback in IRQ context on PREEMPT_RT is not an option due its usage of wake_up_all(). Since this callback may run in thread context, it needs to acquire ring_buffer_per_cpu::reader_lock with disabling interrupts and may not assume that they are disabled. Use raw_spinlock_irqsave() to acquire ring_buffer_per_cpu::reader_lock. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260911102152.YEtwkBj9@linutronix.de Fixes: 68282dd930ea3 ("ring-buffer: Fix resetting of shortest_full") Reviewed-by: Vincent Donnefort Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 0e30c7bd6045..9bc8ce8c5676 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -904,14 +904,13 @@ static void rb_wake_up_waiters(struct irq_work *work) struct ring_buffer_per_cpu *cpu_buffer =3D container_of(rbwork, struct ring_buffer_per_cpu, irq_work); =20 - /* Called from interrupt context */ - raw_spin_lock(&cpu_buffer->reader_lock); - rbwork->wakeup_full =3D false; - rbwork->full_waiters_pending =3D false; + scoped_guard(raw_spinlock_irqsave, &cpu_buffer->reader_lock) { + rbwork->wakeup_full =3D false; + rbwork->full_waiters_pending =3D false; =20 - /* Waking up all waiters, they will reset the shortest full */ - cpu_buffer->shortest_full =3D 0; - raw_spin_unlock(&cpu_buffer->reader_lock); + /* Waking up all waiters, they will reset the shortest full */ + cpu_buffer->shortest_full =3D 0; + } =20 wake_up_all(&rbwork->full_waiters); } --=20 2.53.0