From: Greg KH <gregkh@linuxfoundation.org>
To: George Guo <dongtai.guo@linux.dev>
Cc: tom.zanussi@linux.intel.com, stable@vger.kernel.org,
George Guo <guodongtai@kylinos.cn>
Subject: Re: [PATCH 4.19.y v3 1/2] tracing: Remove unnecessary hist_data destroy in destroy_synth_var_refs()
Date: Thu, 11 Apr 2024 09:48:49 +0200 [thread overview]
Message-ID: <2024041151-blurt-garden-e741@gregkh> (raw)
In-Reply-To: <20240409021038.1695963-2-dongtai.guo@linux.dev>
On Tue, Apr 09, 2024 at 10:10:37AM +0800, George Guo wrote:
> From: George Guo <guodongtai@kylinos.cn>
No, you are not the author of this :(
> commit 912201345f7c39e6b0ac283207be2b6641fa47b9 upstream.
>
> The destroy_synth_var_refs() destroyed hist_data, casusing a double-free
> error flagged by KASAN.
>
> This is tested via "./ftracetest test.d/trigger/inter-event/
> trigger-field-variable-support.tc"
>
> ==================================================================
> BUG: KASAN: use-after-free in destroy_hist_field+0x115/0x140
> Read of size 4 at addr ffff888012e95318 by task ftracetest/1858
>
> CPU: 1 PID: 1858 Comm: ftracetest Kdump: loaded Tainted: GE 4.19.90-89 #24
> Source Version: Unknown
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0
> Call Trace:
> dump_stack+0xcb/0x10b
> print_address_description.cold+0x54/0x249
> kasan_report_error.cold+0x63/0xab
> ? destroy_hist_field+0x115/0x140
> __asan_report_load4_noabort+0x8d/0xa0
> ? destroy_hist_field+0x115/0x140
> destroy_hist_field+0x115/0x140
> destroy_hist_data+0x4e4/0x9a0
> event_hist_trigger_free+0x212/0x2f0
> ? update_cond_flag+0x128/0x170
> ? event_hist_trigger_func+0x2880/0x2880
> hist_unregister_trigger+0x2f2/0x4f0
> event_hist_trigger_func+0x168c/0x2880
> ? tracing_map_read_var_once+0xd0/0xd0
> ? create_key_field+0x520/0x520
> ? __mutex_lock_slowpath+0x10/0x10
> event_trigger_write+0x2f4/0x490
> ? trigger_start+0x180/0x180
> ? __fget_light+0x369/0x5d0
> ? count_memcg_event_mm+0x104/0x2b0
> ? trigger_start+0x180/0x180
> __vfs_write+0x81/0x100
> vfs_write+0x1e1/0x540
> ksys_write+0x12a/0x290
> ? __ia32_sys_read+0xb0/0xb0
> ? __close_fd+0x1d3/0x280
> do_syscall_64+0xe3/0x2d0
> entry_SYSCALL_64_after_hwframe+0x5c/0xc1
> RIP: 0033:0x7efdd342ee04
> Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48
> 8d 05 39 34 0c 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff
> ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5
> RSP: 002b:00007ffda01f5e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 00000000000000b4 RCX: 00007efdd342ee04
> RDX: 00000000000000b4 RSI: 000055c5b41b1e90 RDI: 0000000000000001
> RBP: 000055c5b41b1e90 R08: 000000000000000a R09: 0000000000000000
> R10: 000000000000000a R11: 0000000000000246 R12: 00007efdd34ed5c0
> R13: 00000000000000b4 R14: 00007efdd34ed7c0 R15: 00000000000000b4
> ==================================================================
>
> So remove the destroy_synth_var_refs() call for that hist_data.
That is not the commit log for the referenced commit.
>
> Fixes: c282a386a397 ("tracing: Add 'onmatch' hist trigger action support")
> Signed-off-by: George Guo <guodongtai@kylinos.cn>
And you dropped all of the people on the original commit :(
Please fix all of this up if you wish to have these backports applied.
thanks,
greg k-h
next prev parent reply other threads:[~2024-04-11 7:48 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-09 2:10 [PATCH 4.19.y v3 0/2] Fix stable-4.19 use-after-free bug George Guo
2024-04-09 2:10 ` [PATCH 4.19.y v3 1/2] tracing: Remove unnecessary hist_data destroy in destroy_synth_var_refs() George Guo
2024-04-11 7:48 ` Greg KH [this message]
2024-04-09 2:10 ` [PATCH 4.19.y v3 2/2] tracing: Remove unnecessary var destroy in onmax_destroy() George Guo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024041151-blurt-garden-e741@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=dongtai.guo@linux.dev \
--cc=guodongtai@kylinos.cn \
--cc=stable@vger.kernel.org \
--cc=tom.zanussi@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.