tracing fixes for v6.19:

- Fix a crash with passing a stacktrace between synthetic events
 
   A synthetic event is an event that combines two events into a single event
   that can display fields from both events as well as the time delta that
   took place between the events. It can also pass a stacktrace from the
   first event so that it can be displayed by the synthetic event (this is
   useful to get a stacktrace of a task scheduling out when blocked and
   recording the time it was blocked for).
 
   A synthetic event can also connect an existing synthetic event to another
   event. An issue was found that if the first synthetic event had a stacktrace
   as one of its fields, and that stacktrace field was passed to the new
   synthetic event to be displayed, it would crash the kernel. This was due to
   the stacktrace not being saved as a stacktrace but was still marked as one.
   When the stacktrace was read, it would try to read an array but instead read
   the integer metadata of the stacktrace and dereferenced a bad value.
 
   Fix this by saving the stacktrace field as a stracktrace.
 
 - Fix possible overflow in cmp_mod_entry() compare function
 
   A binary search is used to find a module address and if the addresses are
   greater than 2GB apart it could lead to truncation and cause a bad search
   result. Use normal compares instead of a subtraction between addresses to
   calculate the compare value.
 
 - Fix output of entry arguments in function graph tracer
 
   Depending on the configurations enabled, the entry can be two different
   types that hold the argument array. The macro FGRAPH_ENTRY_ARGS() is used
   to find the correct arguments from the given type. One location was missed
   and still referenced the arguments directly via entry->args and could
   produce the wrong value depending on how the kernel was configured.
 
 - Fix memory leak in scripts/tracepoint-update build tool
 
   If the array fails to allocate, the memory for the values needs to be
   freed and was not. Free the allocated values if the array failed to
   allocate.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaXUQLxQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qgsJAQDgtWH9DWUkJKgzXTkiOA0l8JArPOVf
 tCSMla2wWJA70QD/as2ptacYAFU9v1oxO5YIgsKOLFBF68ZUIhJtvXpqtAE=
 =JeC6
 -----END PGP SIGNATURE-----

Merge tag 'trace-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing fixes from Steven Rostedt:

 - Fix a crash with passing a stacktrace between synthetic events

   A synthetic event is an event that combines two events into a single
   event that can display fields from both events as well as the time
   delta that took place between the events. It can also pass a
   stacktrace from the first event so that it can be displayed by the
   synthetic event (this is useful to get a stacktrace of a task
   scheduling out when blocked and recording the time it was blocked
   for).

   A synthetic event can also connect an existing synthetic event to
   another event. An issue was found that if the first synthetic event
   had a stacktrace as one of its fields, and that stacktrace field was
   passed to the new synthetic event to be displayed, it would crash the
   kernel. This was due to the stacktrace not being saved as a
   stacktrace but was still marked as one. When the stacktrace was read,
   it would try to read an array but instead read the integer metadata
   of the stacktrace and dereferenced a bad value.

   Fix this by saving the stacktrace field as a stacktrace.

 - Fix possible overflow in cmp_mod_entry() compare function

   A binary search is used to find a module address and if the addresses
   are greater than 2GB apart it could lead to truncation and cause a
   bad search result. Use normal compares instead of a subtraction
   between addresses to calculate the compare value.

 - Fix output of entry arguments in function graph tracer

   Depending on the configurations enabled, the entry can be two
   different types that hold the argument array. The macro
   FGRAPH_ENTRY_ARGS() is used to find the correct arguments from the
   given type. One location was missed and still referenced the
   arguments directly via entry->args and could produce the wrong value
   depending on how the kernel was configured.

 - Fix memory leak in scripts/tracepoint-update build tool

   If the array fails to allocate, the memory for the values needs to be
   freed and was not. Free the allocated values if the array failed to
   allocate.

* tag 'trace-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  scripts/tracepoint-update: Fix memory leak in add_string() on failure
  function_graph: Fix args pointer mismatch in print_graph_retval()
  tracing: Avoid possible signed 64-bit truncation
  tracing: Fix crash on synthetic stacktrace field usage
This commit is contained in:
Linus Torvalds 2026-01-24 17:18:57 -08:00
commit b83a8ff87a
5 changed files with 23 additions and 6 deletions

View file

@ -6115,10 +6115,10 @@ static int cmp_mod_entry(const void *key, const void *pivot)
unsigned long addr = (unsigned long)key;
const struct trace_mod_entry *ent = pivot;
if (addr >= ent[0].mod_addr && addr < ent[1].mod_addr)
return 0;
else
return addr - ent->mod_addr;
if (addr < ent[0].mod_addr)
return -1;
return addr >= ent[1].mod_addr;
}
/**

View file

@ -2057,6 +2057,15 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data,
hist_field->fn_num = HIST_FIELD_FN_RELDYNSTRING;
else
hist_field->fn_num = HIST_FIELD_FN_PSTRING;
} else if (field->filter_type == FILTER_STACKTRACE) {
flags |= HIST_FIELD_FL_STACKTRACE;
hist_field->size = MAX_FILTER_STR_VAL;
hist_field->type = kstrdup_const(field->type, GFP_KERNEL);
if (!hist_field->type)
goto free;
hist_field->fn_num = HIST_FIELD_FN_STACK;
} else {
hist_field->size = field->size;
hist_field->is_signed = field->is_signed;

View file

@ -130,7 +130,9 @@ static int synth_event_define_fields(struct trace_event_call *call)
struct synth_event *event = call->data;
unsigned int i, size, n_u64;
char *name, *type;
int filter_type;
bool is_signed;
bool is_stack;
int ret = 0;
for (i = 0, n_u64 = 0; i < event->n_fields; i++) {
@ -138,8 +140,12 @@ static int synth_event_define_fields(struct trace_event_call *call)
is_signed = event->fields[i]->is_signed;
type = event->fields[i]->type;
name = event->fields[i]->name;
is_stack = event->fields[i]->is_stack;
filter_type = is_stack ? FILTER_STACKTRACE : FILTER_OTHER;
ret = trace_define_field(call, type, name, offset, size,
is_signed, FILTER_OTHER);
is_signed, filter_type);
if (ret)
break;

View file

@ -901,7 +901,7 @@ static void print_graph_retval(struct trace_seq *s, struct ftrace_graph_ent_entr
trace_seq_printf(s, "%ps", func);
if (args_size >= FTRACE_REGS_MAX_ARGS * sizeof(long)) {
print_function_args(s, entry->args, (unsigned long)func);
print_function_args(s, FGRAPH_ENTRY_ARGS(entry), (unsigned long)func);
trace_seq_putc(s, ';');
} else
trace_seq_puts(s, "();");

View file

@ -49,6 +49,8 @@ static int add_string(const char *str, const char ***vals, int *count)
array = realloc(array, sizeof(char *) * size);
if (!array) {
fprintf(stderr, "Failed memory allocation\n");
free(*vals);
*vals = NULL;
return -1;
}
*vals = array;