Re: [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount

[Steven Rostedt]

On Wed, 14 Oct 2026 10:30:12 +0000
Lee Jones <l...@kernel.org> wrote:

> In event_hist_trigger_parse() and hist_unreg_all(), the histogram
> registration and unregistration paths look up find_synth_event() using
> trace_event_name(file->event_call) and adjust se->ref if a match is
> found.
> 
> Because find_synth_event() only compares the event basename, registering
> or removing a histogram on a non-synthetic trace event whose basename
> matches a synthetic event erroneously modifies the synthetic event's
> reference count.  If a histogram is registered on the non-synthetic
> event before the synthetic event is created and removed afterwards,
> se->ref is decremented without a matching increment, allowing the
> synthetic event to be freed while an active histogram action still holds
> a pointer to it.
> 
> Verify that &se->call matches file->event_call before adjusting se->ref.
> 
> Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> Cc: sta...@vger.kernel.org
> Signed-off-by: Lee Jones <l...@kernel.org>

Hi,

Thanks for the patch...

> ---
>  kernel/trace/trace_events_hist.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c 
> b/kernel/trace/trace_events_hist.c
> index 00a1d8522036..71b240b609ea 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file 
> *file)
>  
>                       se_name = trace_event_name(file->event_call);
>                       se = find_synth_event(se_name);
> -                     if (se)
> +                     if (se && &se->call == file->event_call)
>                               se->ref--;
>  
>                       update_cond_flag(file);
> @@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct 
> event_command *cmd_ops,
>               event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
>               se_name = trace_event_name(file->event_call);
>               se = find_synth_event(se_name);
> -             if (se)
> +             if (se && &se->call == file->event_call)
>                       se->ref--;
>               ret = 0;
>               goto out_free;
> @@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct 
> event_command *cmd_ops,
>  
>       se_name = trace_event_name(file->event_call);
>       se = find_synth_event(se_name);
> -     if (se)
> +     if (se && &se->call == file->event_call)
>               se->ref++;
>   out:
>       if (ret == 0 && glob[0])

Instead of open coding each of these, can we add a new helper function:

struct synth_event *find_synth_event_call(struct trace_event_call *call)
{
        struct synth_event *se;
        const char *name;

        name = trace_event_name(call);
        se = find_synth_event(name);
        return se && se->call == call ? se : NULL;
}

The above can be defined in trace_events_synth.c and exported like
find_synth_event() is.

Then we can remove the se_name from each of these functions.

-- Steve