On Tue, 13 Oct 2026 11:24:48 +0000, Lee Jones <[email protected]> wrote: > In check_synth_field(), when a synthetic event field is a stacktrace > (field->is_stack) and the histogram field is not a "long[" stacktrace > array, validation falls through to the generic size and signedness > comparison. > > Because parse_synth_field() sets a stacktrace field's type to > "__data_loc unsigned long[]", its size is sizeof(u64) and > synth_field_signed() marks it as signed. Consequently, any 8-byte > signed scalar histogram field passes the fallback check, and its scalar > value is subsequently dereferenced as a kernel stacktrace pointer in > get_field_size() and trace_stack(). > > Furthermore, checking strstr(hist_field->type, "long[") is insufficient > because tracepoint fields defined with __bitmask() or __rel_bitmask() > also have type "__data_loc unsigned long[]" or "__rel_loc unsigned > long[]", whilst create_hist_field() treats them as 4-byte scalar values > without HIST_FIELD_FL_STACKTRACE. > > Propagate HIST_FIELD_FL_STACKTRACE to variable references and field > variables (whilst excluding variable aliases from per-element > stacktrace capture), and reject any mismatch between > HIST_FIELD_FL_STACKTRACE and field->is_stack in check_synth_field(). > > Fixes: 00cf3d672a9d ("tracing: Allow synthetic events to pass around > stacktraces") > Cc: [email protected] > Signed-off-by: Lee Jones <[email protected]>
Good catch! Looks good to me. Acked-by: Masami Hiramatsu (Google) <[email protected]> Thanks, -- Masami Hiramatsu (Google) <[email protected]>
