[PATCH v2] tracing/histograms: Verify event_call identity when updating synth_event refcount

[Lee Jones]

In event_hist_trigger_parse() and hist_unreg_all(), the histogram
registration and unregistration paths look up find_synth_event() using
trace_event_name(file->event_call) and adjust se->ref if a match is
found.

Because find_synth_event() only compares the event basename, registering
or removing a histogram on a non-synthetic trace event whose basename
matches a synthetic event erroneously modifies the synthetic event's
reference count.  If a histogram is registered on the non-synthetic
event before the synthetic event is created and removed afterwards,
se->ref is decremented without a matching increment, allowing the
synthetic event to be freed while an active histogram action still holds
a pointer to it.

Introduce find_synth_event_call() to verify that &se->call matches
file->event_call before adjusting se->ref.

Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Cc: sta...@vger.kernel.org
Signed-off-by: Lee Jones <l...@kernel.org>
---
v1 -> v2:
  - Introduce find_synth_event_call() helper instead of open-coding the
    &se->call == file->event_call check at each call site (Steven).

 kernel/trace/trace_events_hist.c  | 11 +++--------
 kernel/trace/trace_events_synth.c | 10 ++++++++++
 kernel/trace/trace_synth.h        |  1 +
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 00a1d8522036..9a789f57ed95 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6792,7 +6792,6 @@ static void hist_unreg_all(struct trace_event_file *file)
        struct event_trigger_data *test, *n;
        struct hist_trigger_data *hist_data;
        struct synth_event *se;
-       const char *se_name;
 
        lockdep_assert_held(&event_mutex);
 
@@ -6805,8 +6804,7 @@ static void hist_unreg_all(struct trace_event_file *file)
                        list_del_rcu(&test->list);
                        trace_event_trigger_enable_disable(file, 0);
 
-                       se_name = trace_event_name(file->event_call);
-                       se = find_synth_event(se_name);
+                       se = find_synth_event_call(file->event_call);
                        if (se)
                                se->ref--;
 
@@ -6830,7 +6828,6 @@ static int event_hist_trigger_parse(struct event_command 
*cmd_ops,
        struct hist_trigger_data *hist_data;
        char *param, *filter, *p, *start;
        struct synth_event *se;
-       const char *se_name;
        bool remove;
        int ret = 0;
 
@@ -6924,8 +6921,7 @@ static int event_hist_trigger_parse(struct event_command 
*cmd_ops,
                }
 
                event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
-               se_name = trace_event_name(file->event_call);
-               se = find_synth_event(se_name);
+               se = find_synth_event_call(file->event_call);
                if (se)
                        se->ref--;
                ret = 0;
@@ -6960,8 +6956,7 @@ static int event_hist_trigger_parse(struct event_command 
*cmd_ops,
        if (ret)
                goto out_unreg;
 
-       se_name = trace_event_name(file->event_call);
-       se = find_synth_event(se_name);
+       se = find_synth_event_call(file->event_call);
        if (se)
                se->ref++;
  out:
diff --git a/kernel/trace/trace_events_synth.c 
b/kernel/trace/trace_events_synth.c
index dc15658a887c..e2870212e58d 100644
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -914,6 +914,16 @@ struct synth_event *find_synth_event(const char *name)
        return NULL;
 }
 
+struct synth_event *find_synth_event_call(struct trace_event_call *call)
+{
+       struct synth_event *se;
+       const char *name;
+
+       name = trace_event_name(call);
+       se = find_synth_event(name);
+       return se && &se->call == call ? se : NULL;
+}
+
 static struct trace_event_fields synth_event_fields_array[] = {
        { .type = TRACE_FUNCTION_TYPE,
          .define_fields = synth_event_define_fields },
diff --git a/kernel/trace/trace_synth.h b/kernel/trace/trace_synth.h
index 43f6fb6078db..d4ebf01b7049 100644
--- a/kernel/trace/trace_synth.h
+++ b/kernel/trace/trace_synth.h
@@ -37,5 +37,6 @@ struct synth_event {
 };
 
 extern struct synth_event *find_synth_event(const char *name);
+extern struct synth_event *find_synth_event_call(struct trace_event_call 
*call);
 
 #endif /* __TRACE_SYNTH_H */
-- 
2.56.0.212.g129ede20d9-goog