From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752501AbcF2ABu (ORCPT ); Tue, 28 Jun 2016 20:01:50 -0400 Received: from mga14.intel.com ([192.55.52.115]:14586 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752325AbcF2ABs (ORCPT ); Tue, 28 Jun 2016 20:01:48 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.26,543,1459839600"; d="scan'208";a="726515616" Message-ID: <57730FEA.7050102@linux.intel.com> Date: Tue, 28 Jun 2016 19:01:46 -0500 From: Tom Zanussi User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Steven Rostedt , Dmitry Vyukov CC: Ingo Molnar , LKML Subject: Re: trace: use-after-free in hist_unreg_all References: <20160628104309.4bbafced@gandalf.local.home> In-Reply-To: <20160628104309.4bbafced@gandalf.local.home> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Steve, On 06/28/2016 09:43 AM, Steven Rostedt wrote: > On Tue, 28 Jun 2016 14:58:50 +0200 > Dmitry Vyukov wrote: > >> Hello, >> >> While running tools/testing/selftests test suite with KASAN I hit the >> following use-after-free report: >> >> >> >> ================================================================== >> BUG: KASAN: use-after-free in hist_unreg_all+0x1a1/0x1d0 at addr >> ffff880031632cc0 >> Read of size 8 by task ftracetest/7413 >> ============================================================================= >> BUG kmalloc-128 (Not tainted): kasan: bad access detected >> ----------------------------------------------------------------------------- > > Thanks for the report. Can you check if this patch fixes the issue? > > -- Steve > > diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c > index 0c05b8a99806..948adb4b6761 100644 > --- a/kernel/trace/trace_events_hist.c > +++ b/kernel/trace/trace_events_hist.c > @@ -1699,9 +1699,9 @@ hist_enable_get_trigger_ops(char *cmd, char *param) > > static void hist_enable_unreg_all(struct trace_event_file *file) This does fix the problem, if put on hist_unreg_all() instead of this ;-) Actually, with that gone, I see another problem with the multihist test, which I'm digging into now. Actually, I should really run through my whole testsuite with KASAN turned on... Thanks for the initial patch, in any case. Tom > { > - struct event_trigger_data *test; > + struct event_trigger_data *test, *n; > > - list_for_each_entry_rcu(test, &file->triggers, list) { > + list_for_each_entry_safe(test, n, &file->triggers, list) { > if (test->cmd_ops->trigger_type == ETT_HIST_ENABLE) { > list_del_rcu(&test->list); > update_cond_flag(file); >