From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, Steven Rostedt <rostedt@goodmis.org>,
Masami Hiramatsu <mhiramat@kernel.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Tom Zanussi <tom.zanussi@linux.intel.com>,
Fengguang Wu <fengguang.wu@intel.com>,
linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH] tracing/histograms: Verify event_call identity when updating synth_event refcount
Date: Wed, 14 Oct 2026 10:30:12 +0000 [thread overview]
Message-ID: <20261014103012.744589-1-lee@kernel.org> (raw)
In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.
Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count. If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.
Verify that &se->call matches file->event_call before adjusting se->ref.
Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
kernel/trace/trace_events_hist.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 00a1d8522036..71b240b609ea 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file)
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref--;
update_cond_flag(file);
@@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref--;
ret = 0;
goto out_free;
@@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
se_name = trace_event_name(file->event_call);
se = find_synth_event(se_name);
- if (se)
+ if (se && &se->call == file->event_call)
se->ref++;
out:
if (ret == 0 && glob[0])
--
2.56.0.385.gd3acb90ef8-goog
reply other threads:[~2026-10-14 10:30 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261014103012.744589-1-lee@kernel.org \
--to=lee@kernel.org \
--cc=fengguang.wu@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
--cc=tom.zanussi@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox