> - [High] Error unwinding in event_hist_trigger_parse() causes Use-After-Free
> and Double-Free of hist_data, and leaves dangling trigger_data on the
> global named_triggers list.
This cannot happen on this base. tracing_set_clock() runs before
cmd_ops->init(), not after -- 6ede78d0563a ("tracing: Set the trace clock
before registering the histogram trigger") swapped them -- and the only code
after init() is the if (named_data) destroy block, which cannot fail. Once
hist_register_trigger() succeeds, out_free is unreachable anyway:
hist_trigger_enable() failure goes to out_unreg, which 92383cef6679 ("tracing:
Undo the registration when enabling the histogram trigger fails") made skip
the free.
> - [High] Use-after-free of the compatible hist_data when removing a target
> histogram that uses field variables.
Real, and reproduced under KASAN. Fix sent:
https://lore.kernel.org/all/[email protected]/
