In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found. Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it. Verify that &se->call matches file->event_call before adjusting se->ref. Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events") Cc: stable@vger.kernel.org Signed-off-by: Lee Jones --- kernel/trace/trace_events_hist.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 00a1d8522036..71b240b609ea 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6807,7 +6807,7 @@ static void hist_unreg_all(struct trace_event_file *file) se_name = trace_event_name(file->event_call); se = find_synth_event(se_name); - if (se) + if (se && &se->call == file->event_call) se->ref--; update_cond_flag(file); @@ -6926,7 +6926,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, event_trigger_unregister(cmd_ops, file, glob+1, trigger_data); se_name = trace_event_name(file->event_call); se = find_synth_event(se_name); - if (se) + if (se && &se->call == file->event_call) se->ref--; ret = 0; goto out_free; @@ -6962,7 +6962,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, se_name = trace_event_name(file->event_call); se = find_synth_event(se_name); - if (se) + if (se && &se->call == file->event_call) se->ref++; out: if (ret == 0 && glob[0]) -- 2.56.0.385.gd3acb90ef8-goog