On Tue, 2026-09-15 at 08:47 +0900, Donggeun Yoo wrote: > create_field_var_hist() creates a histogram on the matched event to > supply a field variable, and records it on the target so it can be torn > down later: > > hist_data = find_compatible_hist(target_hist_data, file); > ... > /* Save the compatible histogram information */ > var_hist->hist_data = hist_data; > > hist_data is not the histogram it creates. It is one that was already > there, whose keys the new one copies. The saved pointer has a single > user, unregister_field_var_hists(), which runs when the target is > removed: > > file = hist_data->field_var_hists[i]->hist_data->event_file; > > find_compatible_hist() matches on keys alone, so it can pick one with no > variables of its own. check_var_refs() then returns false and the user > can remove it while the target still points at it: > > BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 > Read of size 8 at addr ffff8880093b90e0 by task init/1 > > Freed by task 1: > kfree+0x154/0x420 > event_hist_trigger_free+0x1d5/0x320 > event_hist_trigger_parse+0x35f3/0x69e0 > trigger_process_regex+0x1a6/0x250 > > Save the event file instead. It is all the dereference ever wanted, and > it does not go away when the user removes a trigger. > > Reported-by: Sashiko <[email protected]> > Link: https://lore.kernel.org/all/[email protected]/ > Cc: [email protected] > Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'") > Signed-off-by: Donggeun Yoo <[email protected]> > Assisted-by: Claude:claude-fable-5
Looks fine to me, thanks. Acked-by: Tom Zanussi <[email protected]> > --- > x86_64 under QEMU/KVM, CONFIG_KASAN=y, 2 CPUs, base 587858367581. One > kernel config; one initramfs image per arm, differing only where stated. > > A compatible histogram on sched_waking, an onmatch() target on > sched_switch naming sched_waking's prio so a field variable is forced, > then the compatible histogram removed, then the target: > > echo 'hist:keys=pid' > events/sched/sched_waking/trigger > echo 'hist:keys=next_pid:onmatch(sched.sched_waking).my_synth(prio)' \ > > events/sched/sched_switch/trigger > echo '!hist:keys=pid' > events/sched/sched_waking/trigger > echo '!hist:keys=next_pid:onmatch(...)' > events/sched/sched_switch/trigger > > unfixed 1 KASAN slab-use-after-free, above > unfixed, 3rd command omitted 0 > patched 0 > > The second arm is the control: the other three commands are identical, so > the report is the removal and not the harness. > > The read is on freed memory rather than a pointer that is reliably wrong > -- whether the '!hist' still reaches the right file depends on what the > slab has handed out since. > > trigger-field-variable-support.tc covers this path, and its removal step > goes through the line this patch changes. Run by hand against both arms, > since the initramfs carries no ftracetest: inter-event histogram PASS, > field variable created PASS, field variable removed PASS, on both, with > no KASAN report on either. > kernel/trace/trace_events_hist.c | 8 ++++---- > 1 file changed, 4 insertions(+), 4 deletions(-) > > diff --git a/kernel/trace/trace_events_hist.c > b/kernel/trace/trace_events_hist.c > index 8af97fd4ee2d..cc22bba011b2 100644 > --- a/kernel/trace/trace_events_hist.c > +++ b/kernel/trace/trace_events_hist.c > @@ -549,7 +549,7 @@ struct field_var { > }; > > struct field_var_hist { > - struct hist_trigger_data *hist_data; > + struct trace_event_file *file; > char *cmd; > }; > > @@ -3118,8 +3118,8 @@ create_field_var_hist(struct hist_trigger_data > *target_hist_data, > return ERR_PTR(-ENOMEM); > } > > - /* Save the compatible histogram information */ > - var_hist->hist_data = hist_data; > + /* Needed to remove the histogram when the target goes away */ > + var_hist->file = file; > > /* Create the new histogram with our variable */ > ret = event_hist_trigger_parse(&trigger_hist_cmd, file, > @@ -6344,7 +6344,7 @@ static void unregister_field_var_hists(struct > hist_trigger_data *hist_data) > int ret; > > for (i = 0; i < hist_data->n_field_var_hists; i++) { > - file = hist_data->field_var_hists[i]->hist_data->event_file; > + file = hist_data->field_var_hists[i]->file; > cmd = hist_data->field_var_hists[i]->cmd; > ret = event_hist_trigger_parse(&trigger_hist_cmd, file, > "!hist", "hist", cmd); > > base-commit: 587858367581b9c55c3690f4e63382ad622719d4
