On Mon, Sep 07, 2026 at 05:31:12AM +0000, [email protected] wrote: > [Critical] Out-of-bounds loop and invalid pointer free in > tracing_map_destroy_sort_entries when stats allocation fails.
Confirmed, including the reachability the report points at: this patch is what makes that path live again. Reproduced with the stats allocation forced to fail, reading the hist file of a trigger with a .percent value: BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0xa0/0xb0 Read of size 8 at addr ffffc90000045000 by task init/1 tracing_map_destroy_sort_entries+0xa0/0xb0 hist_show+0x6f7/0x1df0 seq_read_iter+0x2b8/0x1190 vfs_read+0x176/0xa40 followed by a fatal page fault a few pages further. The registers at the oops give the bound: the loop's end pointer less the array start, over the pointer size, is 4294967284, which is -ENOMEM as an unsigned int. Fix sent, with Cc: stable and a note that it should be applied before this one: https://lore.kernel.org/linux-trace-kernel/[email protected]/
