linux/kernel/trace
Donggeun Yoo 647c2f97fc tracing: Fix the shift out of bounds in the log2 histogram modifier
The .log2 key modifier files a value under its base-2 order:

  # echo 'hist:keys=bytes_req.log2' > events/kmem/kmalloc/trigger

hist_field_log2() computes that as ilog2(roundup_pow_of_two(val)). The
out-of-line form of roundup_pow_of_two() is

	return 1UL << fls_long(n - 1);

which shifts by 64 on a 64-bit kernel both when n is 0, where n - 1
wraps to ULONG_MAX, and when n is above 2^63. Both are ordinary keys,
because the field fetch hands every value over as a u64: a syscall
argument of 0 reaches the first, and one above 2^63 reaches the second.

Keying sys_enter_lseek on offset.log2 and passing 0, 1, 2, 3, 1000,
2^63+1 and U64_MAX gives

  { offset: ~ 2^1  } hitcount:          1
  { offset: ~ 2^10 } hitcount:          1
  { offset: ~ 2^2  } hitcount:          1
  { offset: ~ 2^0  } hitcount:          4

Keys above 2^63 land in the lowest bucket. With CONFIG_UBSAN_SHIFT=y
the shift is also reported:

  UBSAN: shift-out-of-bounds in include/linux/log2.h:57:13
  shift exponent 64 is too large for 64-bit type 'long unsigned int'
   __ubsan_handle_shift_out_of_bounds.cold+0xdd/0x1cb
   hist_fn_call.cold+0x8b/0xd9
   event_hist_trigger+0x1cc/0x790
   ftrace_syscall_enter+0x197/0x360
   do_syscall_64+0x402/0x4b0

Use order_base_2(), which is ilog2(n - 1) + 1 for n > 1 and 0 below
that. It returns what the old expression returned on every input the
old one was defined for. Where it was not, 0 stays in bucket 0, which
is where x86_64 had been putting it, and the keys above 2^63 move into
bucket 64.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260916002735.808520-1-donggeunyoo.kernel@gmail.com
Fixes: 4b94f5b7b4 ("tracing: Add hist trigger 'log2' modifier")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Assisted-by: Claude:claude-fable-5
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14 17:47:24 -04:00
..
rv rv: Fix 32-bit build of nomiss KUnit test 2026-08-04 16:11:27 +02:00
blktrace.c block-7.0-20260305 2026-03-06 08:36:18 -08:00
bpf_trace.c bpf: Make bpf_trampoline_multi_detach return void 2026-08-13 02:52:23 +02:00
bpf_trace.h
error_report-traces.c
fgraph.c fgraph: Remove unused FGRAPH_MAX_INDEX 2026-09-11 13:37:50 -04:00
fprobe.c fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching() 2026-09-30 08:41:31 +09:00
ftrace_internal.h
ftrace.c ftrace: Use rcu_assign_pointer() for tmp_ops filter hash 2026-09-12 13:27:29 -04:00
Kconfig tracing/probes: Support dumping fetcharg program for debugging dynamic events 2026-07-02 21:12:40 +09:00
kprobe_event_gen_test.c
Makefile tracing: Updates for v7.2: 2026-06-18 20:53:00 -07:00
pid_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pid_list.h
power-traces.c
preemptirq_delay_test.c tracing: Reject invalid preemptirq_delay_test CPU affinity 2026-07-28 07:18:50 -04:00
remote_test_events.h tracing: Add a trace remote module for testing 2026-03-09 12:33:55 -04:00
remote_test.c tracing: Fix desc in error path for the trace remote test module 2026-05-16 16:11:04 -04:00
rethook.c tracing: Fix typo "availabe" in comment 2026-09-11 13:54:14 -04:00
ring_buffer_benchmark.c tracing: Fix subbuf resize races with trace_pipe_raw readers 2026-09-04 16:19:07 -04:00
ring_buffer.c ring-buffer: Do not show buffer_meta for CPUs without a buffer 2026-10-14 17:47:24 -04:00
rpm-traces.c
simple_ring_buffer.c tracing: Fix retry exhaustion in simple ring buffer reader swap 2026-08-27 21:31:41 -04:00
synth_event_gen_test.c
trace_benchmark.c
trace_benchmark.h
trace_boot.c tracing/boot: Add support for eprobe, fprobe, and tprobe events 2026-08-08 21:20:55 +09:00
trace_branch.c tracing/branch: Use pr_warn() instead of printk(KERN_WARNING) 2026-05-21 18:03:08 -04:00
trace_btf.c tracing/probes: Fix BTF kflag check for anonymous struct member access 2026-09-03 09:04:25 +09:00
trace_btf.h tracing/probes: Fix BTF kflag check for anonymous struct member access 2026-09-03 09:04:25 +09:00
trace_clock.c
trace_dynevent.c tracing/boot: Add support for eprobe, fprobe, and tprobe events 2026-08-08 21:20:55 +09:00
trace_dynevent.h
trace_entries.h
trace_eprobe.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
trace_event_perf.c perf/ftrace: Fix WARNING in __unregister_ftrace_function 2026-05-29 11:27:40 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing/filters: Fix false positive match in regex_match_full() 2026-07-29 14:32:11 -04:00
trace_events_hist.c tracing: Fix the shift out of bounds in the log2 histogram modifier 2026-10-14 17:47:24 -04:00
trace_events_inject.c
trace_events_synth.c tracing/synthetic: Free type string on error path 2026-07-07 13:59:55 -04:00
trace_events_trigger.c tracing: Don't dereference trace_event_file in deferred trigger free 2026-09-12 13:27:41 -04:00
trace_events_user.c tracing/user_events: Don't destroy fields when event removal fails 2026-09-11 13:30:15 -04:00
trace_events.c tracing: Restore :mod: trailer after parsing in ftrace_set_clr_event() 2026-09-11 14:01:46 -04:00
trace_export.c
trace_fprobe.c Probes updates for v7.3: 2026-08-20 15:11:52 -07:00
trace_functions_graph.c function_graph: Use the saved entry's size when reprinting it 2026-09-11 13:39:08 -04:00
trace_functions.c ftrace: Take trace_array reference before accessing its ftrace_ops 2026-09-01 16:38:19 -04:00
trace_hwlat.c
trace_irqsoff.c
trace_kdb.c
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing/probes: Treating longer symbol name on event comparation 2026-07-28 23:55:35 +09:00
trace_mmiotrace.c tracing updates for v7.3: 2026-08-19 14:06:14 -07:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Call synchronize_rcu() when unregistering 2026-07-06 14:56:18 -04:00
trace_output.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_output.h
trace_pid.c
trace_preemptirq.c tracing: Add a no-rcu-check version of trace_##event##_enabled() 2026-07-07 10:42:29 -04:00
trace_printk.c kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy() 2026-07-28 07:18:48 -04:00
trace_probe_kernel.h tracing/probes: Fix extra whitespace in trace_probe_kernel.h 2026-07-21 18:00:13 +09:00
trace_probe_tmpl.h tracing/probes: Add this_cpu_read() and this_cpu_ptr() dereference method to fetcharg 2026-07-14 22:43:16 +09:00
trace_probe.c tracing/probes: Fix use-after-free on field name/type of events with multiple probes 2026-09-03 09:04:25 +09:00
trace_probe.h tracing/probes: Fix use-after-free on field name/type of events with multiple probes 2026-09-03 09:04:25 +09:00
trace_recursion_record.c tracing: Switch trace_recursion_record.c code over to use guard() 2026-05-21 18:03:07 -04:00
trace_remote.c tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing 2026-09-13 13:06:43 -04:00
trace_sched_switch.c tracing: Use strscpy() instead of strcpy() in trace_sched_switch 2026-07-28 07:18:50 -04:00
trace_sched_wakeup.c
trace_selftest_dynamic.c
trace_selftest.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_seq.c
trace_snapshot.c tracing: Remove duplicate latency_fsnotify() stub 2026-03-31 14:58:39 -04:00
trace_stack.c ftrace: Take trace_array reference before accessing its ftrace_ops 2026-09-01 16:38:19 -04:00
trace_stat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_stat.h
trace_synth.h
trace_syscalls.c tracing: Make per-template BTF id lists file-local 2026-08-05 22:02:29 -04:00
trace_uprobe.c uprobes: guard trace cleanup against error pointers 2026-09-01 09:50:11 +09:00
trace.c tracing: Take trace_types_lock when dropping the buffer_meta reference 2026-10-14 17:47:24 -04:00
trace.h tracing: Don't dereference trace_event_file in deferred trigger free 2026-09-12 13:27:41 -04:00
tracing_map.c tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
tracing_map.h tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
undefsyms_base.c tracing: Make undefsyms_base.c a first-class citizen 2026-04-22 11:24:41 -04:00