From: George Guo <dongtai.guo@linux.dev>
To: gregkh@linuxfoundation.org, tom.zanussi@linux.intel.com
Cc: stable@vger.kernel.org
Subject: [PATCH 4.19.y v5 0/2] Double-free bug discovery on testing trigger-field-variable-support.tc
Date: Tue, 16 Apr 2024 09:54:30 +0800 [thread overview]
Message-ID: <20240416015432.2282705-1-dongtai.guo@linux.dev> (raw)
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=yes, Size: 3534 bytes --]
1) About v4-0001-tracing-Remove-hist-trigger-synth_var_refs.patch:
The reason I am backporting this patch is that no one found the double-free bug
at that time, then later the code was removed on upstream, but
4.19-stable has the bug.
This is tested via "./ftracetest test.d/trigger/inter-event/
trigger-field-variable-support.tc"
==================================================================
BUG: KASAN: use-after-free in destroy_hist_field+0x115/0x140
Read of size 4 at addr ffff888012e95318 by task ftracetest/1858
CPU: 1 PID: 1858 Comm: ftracetest Kdump: loaded Tainted: GE 4.19.90-89 #24
Source Version: Unknown
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0
Call Trace:
dump_stack+0xcb/0x10b
print_address_description.cold+0x54/0x249
kasan_report_error.cold+0x63/0xab
? destroy_hist_field+0x115/0x140
__asan_report_load4_noabort+0x8d/0xa0
? destroy_hist_field+0x115/0x140
destroy_hist_field+0x115/0x140
destroy_hist_data+0x4e4/0x9a0
event_hist_trigger_free+0x212/0x2f0
? update_cond_flag+0x128/0x170
? event_hist_trigger_func+0x2880/0x2880
hist_unregister_trigger+0x2f2/0x4f0
event_hist_trigger_func+0x168c/0x2880
? tracing_map_read_var_once+0xd0/0xd0
? create_key_field+0x520/0x520
? __mutex_lock_slowpath+0x10/0x10
event_trigger_write+0x2f4/0x490
? trigger_start+0x180/0x180
? __fget_light+0x369/0x5d0
? count_memcg_event_mm+0x104/0x2b0
? trigger_start+0x180/0x180
__vfs_write+0x81/0x100
vfs_write+0x1e1/0x540
ksys_write+0x12a/0x290
? __ia32_sys_read+0xb0/0xb0
? __close_fd+0x1d3/0x280
do_syscall_64+0xe3/0x2d0
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7efdd342ee04
Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48
8d 05 39 34 0c 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff
ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5
RSP: 002b:00007ffda01f5e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00000000000000b4 RCX: 00007efdd342ee04
RDX: 00000000000000b4 RSI: 000055c5b41b1e90 RDI: 0000000000000001
RBP: 000055c5b41b1e90 R08: 000000000000000a R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 00007efdd34ed5c0
R13: 00000000000000b4 R14: 00007efdd34ed7c0 R15: 00000000000000b4
==================================================================
2) About v4-0002-tracing-Use-var_refs-for-hist-trigger-reference-c.patch:
Only v4-0001-tracing-Remove-hist-trigger-synth_var_refs.patch will lead
to compilation errors:
../kernel/trace/trace_events_hist.c: In function ‘find_var_ref’:
../kernel/trace/trace_events_hist.c:1364:36: error: ‘struct hist_trigger_data’ has no member named ‘n_synth_var_refs’; did you mean ‘n_var_refs’?
1364 | for (i = 0; i < hist_data->n_synth_var_refs; i++) {
| ^~~~~~~~~~~~~~~~
| n_var_refs
../kernel/trace/trace_events_hist.c:1365:41: error: ‘struct hist_trigger_data’ has no member named ‘synth_var_refs’; did you mean ‘n_var_refs’?
1365 | hist_field = hist_data->synth_var_refs[i];
| ^~~~~~~~~~~~~~
| n_var_refs
3) Singing off my name on the V5.
Tom Zanussi (2):
tracing: Remove hist trigger synth_var_refs
tracing: Use var_refs[] for hist trigger reference checking
kernel/trace/trace_events_hist.c | 86 ++++----------------------------
1 file changed, 11 insertions(+), 75 deletions(-)
--
2.34.1
next reply other threads:[~2024-04-16 1:54 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-16 1:54 George Guo [this message]
2024-04-16 1:54 ` [PATCH 4.19.y v5 1/2] tracing: Remove hist trigger synth_var_refs George Guo
2024-04-19 11:18 ` Greg KH
2024-04-16 1:54 ` [PATCH 4.19.y v5 2/2] tracing: Use var_refs[] for hist trigger reference checking George Guo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240416015432.2282705-1-dongtai.guo@linux.dev \
--to=dongtai.guo@linux.dev \
--cc=gregkh@linuxfoundation.org \
--cc=stable@vger.kernel.org \
--cc=tom.zanussi@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.