From: Greg KH <gregkh@linuxfoundation.org>
To: George Guo <dongtai.guo@linux.dev>
Cc: stable@vger.kernel.org, George Guo <guodongtai@kylinos.cn>
Subject: Re: [PATCH 4.19 2/2] tracing: Remove unnecessary var destroy in onmax_destroy()
Date: Mon, 1 Apr 2024 14:24:32 +0200 [thread overview]
Message-ID: <2024040106-shirt-announcer-e9bb@gregkh> (raw)
In-Reply-To: <20240401075049.2655077-3-dongtai.guo@linux.dev>
On Mon, Apr 01, 2024 at 03:50:49PM +0800, George Guo wrote:
> From: George Guo <guodongtai@kylinos.cn>
>
> commit ff9d31d0d46672e201fc9ff59c42f1eef5f00c77 upstream.
>
> The onmax_destroy() destroyed the onmax var, casusing a double-free error
> flagged by KASAN.
>
> This is tested via "./ftracetest test.d/trigger/inter-event/
> trigger-onmatch-onmax-action-hist.tc".
>
> ==================================================================
> BUG: KASAN: use-after-free in destroy_hist_field+0x1c2/0x200
> Read of size 8 at addr ffff88800a4ad100 by task ftracetest/4731
>
> CPU: 0 PID: 4731 Comm: ftracetest Kdump: loaded Tainted: GE 4.19.90-89 #77
> Source Version: Unknown
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0
> Call Trace:
> dump_stack+0xcb/0x10b
> print_address_description.cold+0x54/0x249
> kasan_report_error.cold+0x63/0xab
> ? destroy_hist_field+0x1c2/0x200
> ? hist_trigger_elt_data_alloc+0x5a0/0x5a0
> __asan_report_load8_noabort+0x8d/0xa0
> ? destroy_hist_field+0x1c2/0x200
> destroy_hist_field+0x1c2/0x200
> onmax_destroy+0x72/0x1e0
> ? hist_trigger_elt_data_alloc+0x5a0/0x5a0
> destroy_hist_data+0x236/0xa40
> event_hist_trigger_free+0x212/0x2f0
> ? update_cond_flag+0x128/0x170
> ? event_hist_trigger_func+0x2880/0x2880
> hist_unregister_trigger+0x2f2/0x4f0
> event_hist_trigger_func+0x168c/0x2880
> ? tracing_map_cmp_u64+0xa0/0xa0
> ? onmatch_create.constprop.0+0xf50/0xf50
> ? __mutex_lock_slowpath+0x10/0x10
> event_trigger_write+0x2f4/0x490
> ? trigger_start+0x180/0x180
> ? __fget_light+0x369/0x5d0
> ? count_memcg_event_mm+0x104/0x2b0
> ? trigger_start+0x180/0x180
> __vfs_write+0x81/0x100
> vfs_write+0x1e1/0x540
> ksys_write+0x12a/0x290
> ? __ia32_sys_read+0xb0/0xb0
> ? __close_fd+0x1d3/0x280
> do_syscall_64+0xe3/0x2d0
> entry_SYSCALL_64_after_hwframe+0x5c/0xc1
> RIP: 0033:0x7fd7f4c44e04
> Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00
> 48 8d 05 39 34 0c 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00
> f0 ff ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5
> RSP: 002b:00007fff10370df8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> RAX: ffffffffffffffda RBX: 000000000000010f RCX: 00007fd7f4c44e04
> RDX: 000000000000010f RSI: 000055fa765df650 RDI: 0000000000000001
> RBP: 000055fa765df650 R08: 000000000000000a R09: 0000000000000000
> R10: 000000000000000a R11: 0000000000000246 R12: 00007fd7f4d035c0
> R13: 000000000000010f R14: 00007fd7f4d037c0 R15: 000000000000010f
> ==================================================================
>
> So remove the onmax_destroy() destroy_hist_field() call for that var.
>
> Fixes: 50450603ec9c("tracing: Add 'onmax' hist trigger action support")
> Signed-off-by: George Guo <guodongtai@kylinos.cn>
Again, Fixes: line is incorrect and you lost all of the correct
authorship and review information.
thanks,
greg k-h
prev parent reply other threads:[~2024-04-01 12:24 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-01 7:50 [PATCH 4.19 v2 0/2] Fix stable-4.19 use-after-free bug George Guo
2024-04-01 7:50 ` [PATCH 4.19 v2 1/2] tracing: Remove unnecessary hist_data destroy in destroy_synth_var_refs() George Guo
2024-04-01 12:23 ` Greg KH
2024-04-01 7:50 ` [PATCH 4.19 2/2] tracing: Remove unnecessary var destroy in onmax_destroy() George Guo
2024-04-01 12:24 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2024040106-shirt-announcer-e9bb@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=dongtai.guo@linux.dev \
--cc=guodongtai@kylinos.cn \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox