github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-30 05:54:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
7f711e6235
linux/kernel/trace
History
Donggeun Yoo 7f711e6235 tracing: Fix memory corruption from a "STACKTRACE" histogram key 
"cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined
with an offset and a size of zero so that the filter code can match them
by name. parse_field() maps them onto their common_* equivalents for
backward compatibility, but unlike the common_* names it hands the
placeholder back to the caller instead of NULL.

create_hist_field() takes a non-NULL field as a promise that the record
carries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc
word is read from offset 0, that is from common_type, and its low 16
bits are followed as an offset into the record. What is found there
becomes the length of an unbounded memcpy. Pick an event whose id is
small enough that the offset stays inside its own record and the length
is a kernel text address:

  # cd /sys/kernel/tracing
  # echo 'hist:keys=STACKTRACE' > events/ftrace/print/trigger
  # echo hello > trace_marker

  Oops: general protection fault, probably for non-canonical address
  RIP: 0010:rb_next+0x23/0x60
   </IRQ>
  RIP: 0010:memcpy+0xc/0x30
   event_hist_trigger+0x2e7/0x12c0
  Kernel panic - not syncing: Fatal exception in interrupt

Leave the field NULL, which is what the comment above the branch says
the code does and what common_stacktrace already does. FILTER_CPU and
FILTER_COMM are left alone, their create_hist_field() branches never
look at the field.

Cc: stable@vger.kernel.org
Fixes: 4b512860bd ("tracing: Rename stacktrace field to common_stacktrace")
Link: https://patch.msgid.link/20260907155045.692664-3-donggeunyoo.kernel@gmail.com
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-09-11 14:01:36 -04:00
..
rv rv: Fix 32-bit build of nomiss KUnit test 2026-08-04 16:11:27 +02:00
blktrace.c block-7.0-20260305 2026-03-06 08:36:18 -08:00
bpf_trace.c bpf: Make bpf_trampoline_multi_detach return void 2026-08-13 02:52:23 +02:00
bpf_trace.h
error_report-traces.c
fgraph.c fgraph: Remove unused FGRAPH_MAX_INDEX 2026-09-11 13:37:50 -04:00
fprobe.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
ftrace_internal.h
ftrace.c ftrace: Synchronize the initialization of ftrace_ops 2026-09-02 11:08:21 -04:00
Kconfig tracing/probes: Support dumping fetcharg program for debugging dynamic events 2026-07-02 21:12:40 +09:00
kprobe_event_gen_test.c
Makefile tracing: Updates for v7.2: 2026-06-18 20:53:00 -07:00
pid_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pid_list.h trace/pid_list: optimize pid_list->lock contention 2025-11-13 15:15:54 -05:00
power-traces.c PM: cpufreq: powernv/tracing: Move powernv_throttle trace event 2025-07-21 16:40:56 -04:00
preemptirq_delay_test.c tracing: Reject invalid preemptirq_delay_test CPU affinity 2026-07-28 07:18:50 -04:00
remote_test_events.h tracing: Add a trace remote module for testing 2026-03-09 12:33:55 -04:00
remote_test.c tracing: Fix desc in error path for the trace remote test module 2026-05-16 16:11:04 -04:00
rethook.c tracing: Fix typo "availabe" in comment 2026-09-11 13:54:14 -04:00
ring_buffer_benchmark.c tracing: Fix subbuf resize races with trace_pipe_raw readers 2026-09-04 16:19:07 -04:00
ring_buffer.c tracing fixes for v7.3: 2026-09-06 14:21:24 -07:00
rpm-traces.c
simple_ring_buffer.c tracing: Fix retry exhaustion in simple ring buffer reader swap 2026-08-27 21:31:41 -04:00
synth_event_gen_test.c
trace_benchmark.c
trace_benchmark.h
trace_boot.c tracing/boot: Add support for eprobe, fprobe, and tprobe events 2026-08-08 21:20:55 +09:00
trace_branch.c tracing/branch: Use pr_warn() instead of printk(KERN_WARNING) 2026-05-21 18:03:08 -04:00
trace_btf.c tracing/probes: Fix BTF kflag check for anonymous struct member access 2026-09-03 09:04:25 +09:00
trace_btf.h tracing/probes: Fix BTF kflag check for anonymous struct member access 2026-09-03 09:04:25 +09:00
trace_clock.c tracing: Use atomic64_inc_return() in trace_clock_counter() 2024-10-09 19:59:49 -04:00
trace_dynevent.c tracing/boot: Add support for eprobe, fprobe, and tprobe events 2026-08-08 21:20:55 +09:00
trace_dynevent.h tracing: probes: Fix a possible race in trace_probe_log APIs 2025-05-13 22:23:34 +09:00
trace_entries.h tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_eprobe.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
trace_event_perf.c perf/ftrace: Fix WARNING in __unregister_ftrace_function 2026-05-29 11:27:40 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing/filters: Fix false positive match in regex_match_full() 2026-07-29 14:32:11 -04:00
trace_events_hist.c tracing: Fix memory corruption from a "STACKTRACE" histogram key 2026-09-11 14:01:36 -04:00
trace_events_inject.c
trace_events_synth.c tracing/synthetic: Free type string on error path 2026-07-07 13:59:55 -04:00
trace_events_trigger.c tracing: Cleanup event_enable_trigger_parse() by using __free() 2026-08-11 10:23:38 -04:00
trace_events_user.c tracing/user_events: Don't destroy fields when event removal fails 2026-09-11 13:30:15 -04:00
trace_events.c tracing: Have show_event_filters/triggers files take trace array ref 2026-09-01 16:36:52 -04:00
trace_export.c tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_fprobe.c Probes updates for v7.3: 2026-08-20 15:11:52 -07:00
trace_functions_graph.c function_graph: Use the saved entry's size when reprinting it 2026-09-11 13:39:08 -04:00
trace_functions.c ftrace: Take trace_array reference before accessing its ftrace_ops 2026-09-01 16:38:19 -04:00
trace_hwlat.c tracing: Fix false sharing in hwlat get_sample() 2026-02-10 03:36:39 -05:00
trace_irqsoff.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kdb.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing/probes: Treating longer symbol name on event comparation 2026-07-28 23:55:35 +09:00
trace_mmiotrace.c tracing updates for v7.3: 2026-08-19 14:06:14 -07:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Call synchronize_rcu() when unregistering 2026-07-06 14:56:18 -04:00
trace_output.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_output.h tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_pid.c tracing: Move pid filtering into trace_pid.c 2026-02-08 21:01:13 -05:00
trace_preemptirq.c tracing: Add a no-rcu-check version of trace_##event##_enabled() 2026-07-07 10:42:29 -04:00
trace_printk.c kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy() 2026-07-28 07:18:48 -04:00
trace_probe_kernel.h tracing/probes: Fix extra whitespace in trace_probe_kernel.h 2026-07-21 18:00:13 +09:00
trace_probe_tmpl.h tracing/probes: Add this_cpu_read() and this_cpu_ptr() dereference method to fetcharg 2026-07-14 22:43:16 +09:00
trace_probe.c tracing/probes: Fix use-after-free on field name/type of events with multiple probes 2026-09-03 09:04:25 +09:00
trace_probe.h tracing/probes: Fix use-after-free on field name/type of events with multiple probes 2026-09-03 09:04:25 +09:00
trace_recursion_record.c tracing: Switch trace_recursion_record.c code over to use guard() 2026-05-21 18:03:07 -04:00
trace_remote.c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
trace_sched_switch.c tracing: Use strscpy() instead of strcpy() in trace_sched_switch 2026-07-28 07:18:50 -04:00
trace_sched_wakeup.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_selftest_dynamic.c
trace_selftest.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_seq.c tracing: Add bitmask-list option for human-readable bitmask display 2026-01-26 17:00:50 -05:00
trace_snapshot.c tracing: Remove duplicate latency_fsnotify() stub 2026-03-31 14:58:39 -04:00
trace_stack.c ftrace: Take trace_array reference before accessing its ftrace_ops 2026-09-01 16:38:19 -04:00
trace_stat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_stat.h
trace_synth.h
trace_syscalls.c tracing: Make per-template BTF id lists file-local 2026-08-05 22:02:29 -04:00
trace_uprobe.c uprobes: guard trace cleanup against error pointers 2026-09-01 09:50:11 +09:00
trace.c tracing: Fix comment in tracing_buffers_splice_read() 2026-09-04 16:19:29 -04:00
trace.h tracing: Fix subbuf resize races with trace_pipe_raw readers 2026-09-04 16:19:07 -04:00
tracing_map.c tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
tracing_map.h tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
undefsyms_base.c tracing: Make undefsyms_base.c a first-class citizen 2026-04-22 11:24:41 -04:00