)]}'
{
  "commit": "6ede78d0563a2a3ae3e46f9c07cedb5d79645429",
  "tree": "048d2840572376578436ca9f37c131038da8276d",
  "parents": [
    "0999d3e16d13b6299fd7cc7a7fb2825c18e90dd0"
  ],
  "author": {
    "name": "Donggeun Yoo",
    "email": "donggeunyoo.kernel@gmail.com",
    "time": "Mon Sep 07 18:14:15 2026 +0900"
  },
  "committer": {
    "name": "Steven Rostedt",
    "email": "rostedt@goodmis.org",
    "time": "Fri Sep 11 13:54:36 2026 -0400"
  },
  "message": "tracing: Set the trace clock before registering the histogram trigger\n\nhist_register_trigger() puts the trigger on the global named_triggers\nlist in cmd_ops-\u003einit(), and only then sets the trace clock:\n\n\tif (data-\u003ecmd_ops-\u003einit) {\n\t\tret \u003d data-\u003ecmd_ops-\u003einit(data);\n\t\tif (ret \u003c 0)\n\t\t\tgoto out;\n\t}\n\n\tif (hist_data-\u003eenable_timestamps) {\n\t\tret \u003d tracing_set_clock(file-\u003etr, hist_data-\u003eattrs-\u003eclock);\n\t\tif (ret) {\n\t\t\thist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock));\n\t\t\tgoto out;\n\t\t}\n\nThe clock string is not checked anywhere before that call, so a named\ntrigger using common_timestamp with an unknown clock fails after it has\nalready become findable. event_hist_trigger_parse() then frees it\nwithout taking it off the list, and the next lookup by name reads the\nfreed object:\n\n ~# cd /sys/kernel/tracing/events/sched/sched_switch\n ~# echo \u0027hist:name\u003dfoo:keys\u003dcommon_pid:ts\u003dcommon_timestamp:clock\u003dbogus\u0027 \u003e trigger\n bash: echo: write error: Invalid argument\n ~# echo \u0027hist:name\u003dfoo:keys\u003dcommon_pid\u0027 \u003e trigger\n\n  BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0\n  Read of size 8 at addr ffff88800915d760 by task init/1\n   find_named_trigger+0xac/0xc0\n   hist_register_trigger+0xc1/0x900\n   event_hist_trigger_parse+0x3146/0x6af0\n   event_trigger_write+0xce/0x160\n  Freed by task 63:\n   kfree+0x154/0x420\n   trigger_kthread_fn+0xfd/0x160\n\nSet the clock before the trigger is registered, so that nothing which\ncan fail runs after it is published, the way commit 6f86bdeab633\n(\"tracing: Fix bad hist from corrupting named_triggers list\") moved the\nregistration below the rest of the setup.\n\ntracing_set_filter_buffering() is reference counted, so the init failure\npath has to drop the reference that the clock block now takes first.\n\nCc: stable@vger.kernel.org\nFixes: a4072fe85ba3 (\"tracing: Add a clock attribute for hist triggers\")\nLink: https://patch.msgid.link/20260907091415.554535-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5e00da2d5b1a907bb8e191926b4fffb14028e804",
      "old_mode": 33188,
      "old_path": "kernel/trace/trace_events_hist.c",
      "new_id": "1889e310b73cb8e55ca4a1fab14f955352471745",
      "new_mode": 33188,
      "new_path": "kernel/trace/trace_events_hist.c"
    }
  ]
}