From: Greg KH <gregkh@linuxfoundation.org>
To: George Guo <dongtai.guo@linux.dev>
Cc: stable@vger.kernel.org, George Guo <guodongtai@kylinos.cn>
Subject: Re: [PATCH 4.19 2/2] tracing: Remove unnecessary var destroy in onmax_destroy()
Date: Mon, 1 Apr 2024 14:24:32 +0200 [thread overview]
Message-ID: <2024040106-shirt-announcer-e9bb@gregkh> (raw)
In-Reply-To: <20240401075049.2655077-3-dongtai.guo@linux.dev>
On Mon, Apr 01, 2024 at 03:50:49PM +0800, George Guo wrote:
> From: George Guo <guodongtai@kylinos.cn>
>
> commit ff9d31d0d46672e201fc9ff59c42f1eef5f00c77 upstream.
>
> The onmax_destroy() destroyed the onmax var, casusing a double-free error
> flagged by KASAN.
>
> This is tested via "./ftracetest test.d/trigger/inter-event/
> trigger-onmatch-onmax-action-hist.tc".
>
> ==================================================================
> BUG: KASAN: use-after-free in destroy_hist_field+0x1c2/0x200
> Read of size 8 at addr ffff88800a4ad100 by task ftracetest/4731
>
> CPU: 0 PID: 4731 Comm: ftracetest Kdump: loaded Tainted: GE 4.19.90-89 #77
> Source Version: Unknown
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0
> Call Trace:
> dump_stack+0xcb/0x10b
> print_address_description.cold+0x54/0x249
> kasan_report_error.cold+0x63/0xab
> ? destroy_hist_field+0x1c2/0x200
> ? hist_trigger_elt_data_alloc+0x5a0/0x5a0
> __asan_report_load8_noabort+0x8d/0xa0
> ? destroy_hist_field+0x1c2/0x200
> destroy_hist_field+0x1c2/0x200
> onmax_destroy+0x72/0x1e0
> ? hist_trigger_elt_data_alloc+0x5a0/0x5a0
> destroy_hist_data+0x236/0xa40
> event_hist_trigger_free+0x212/0x2f0
> ? update_cond_flag+0x128/0x170
> ? event_hist_trigger_func+0x2880/0x2880
> hist_unregister_trigger+0x2f2/0x4f0
> event_hist_trigger_func+0x168c/0x2880
> ? tracing_map_cmp_u64+0xa0/0xa0
> ? onmatch_create.constprop.0+0xf50/0xf50
> ? __mutex_lock_slowpath+0x10/0x10
> event_trigger_write+0x2f4/0x490
> ? trigger_start+0x180/0x180
> ? __fget_light+0x369/0x5d0
> ? count_memcg_event_mm+0x104/0x2b0
> ? trigger_start+0x180/0x180
> __vfs_write+0x81/0x100
> vfs_write+0x1e1/0x540
> ksys_write+0x12a/0x290
> ? __ia32_sys_read+0xb0/0xb0
> ? __close_fd+0x1d3/0x280
> do_syscall_64+0xe3/0x2d0
> entry_SYSCALL_64_after_hwframe+0x5c/0xc1
> RIP: 0033:0x7fd7f4c44e04
> Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00
> 48 8d 05 39 34 0c 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00
> f0 ff ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5
> RSP: 002b:00007fff10370df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 000000000000010f RCX: 00007fd7f4c44e04
> RDX: 000000000000010f RSI: 000055fa765df650 RDI: 0000000000000001
> RBP: 000055fa765df650 R08: 000000000000000a R09: 0000000000000000
> R10: 000000000000000a R11: 0000000000000246 R12: 00007fd7f4d035c0
> R13: 000000000000010f R14: 00007fd7f4d037c0 R15: 000000000000010f
> ==================================================================
>
> So remove the onmax_destroy() destroy_hist_field() call for that var.
>
> Fixes: 50450603ec9c("tracing: Add 'onmax' hist trigger action support")
> Signed-off-by: George Guo <guodongtai@kylinos.cn>
Again, Fixes: line is incorrect and you lost all of the correct
authorship and review information.
thanks,
greg k-h
prev parent reply other threads:[~2024-04-01 12:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-01 7:50 [PATCH 4.19 v2 0/2] Fix stable-4.19 use-after-free bug George Guo
2024-04-01 7:50 ` [PATCH 4.19 v2 1/2] tracing: Remove unnecessary hist_data destroy in destroy_synth_var_refs() George Guo
2024-04-01 12:23 ` Greg KH
2024-04-01 7:50 ` [PATCH 4.19 2/2] tracing: Remove unnecessary var destroy in onmax_destroy() George Guo
2024-04-01 12:24 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024040106-shirt-announcer-e9bb@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=dongtai.guo@linux.dev \
--cc=guodongtai@kylinos.cn \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.