[PATCH v2 0/2] tracing: Fix NULL dereference when copying keys for a field variable

[Donggeun Yoo]

A hist trigger with an onmatch() action copies the key list of the
compatible histogram it finds on the matched event.  Reading each key's
name straight out of key_field->field->name faults on any pseudo-field
key.  2/2 renders the key with expr_field_str() instead; 1/2 teaches that
renderer to emit a bucket count, which 2/2 needs before it can use it.

Link: https://lore.kernel.org/linux-trace-kernel/20260912094722.3271147-1-donggeunyoo.kernel@xxxxxxxxx/

Changes since v1:
 - Split the single patch in two.
 - Dropped the third change, which gated the ".stacktrace" arm of
   get_hist_field_flags() on hist_field->field.  It fixes nothing:
   hist_field_print() excludes FL_STACKTRACE before it ever calls
   get_hist_field_flags(), and parse_field() takes the "stacktrace"
   modifier on any field.  Measured with and without it: identical
   generated command on all nine key kinds below.
 - 1/2 is not separable from 2/2.  .buckets is refused on a value, so no
   expression can reach expr_field_str() with a bucketed field, and 2/2
   alone turns a working .buckets key into a refused one.  In this order
   no bisection point regresses.

The command create_field_var_hist() generates, for each kind of key the
copied histogram can carry:

  WK key                  unpatched   patched
  pid                     keys=pid    keys=pid
  pid.log2                keys=pid    keys=pid.log2
  pid.buckets=10          keys=pid    keys=pid.buckets=10
  common_cpu              oops        keys=common_cpu
  common_comm             oops        keys=common_comm
  common_timestamp        oops        keys=common_timestamp
  common_timestamp.usecs  oops        keys=common_timestamp.usecs
  common_stacktrace       oops        keys=common_stacktrace.stacktrace
  hitcount                oops        keys=hitcount

x86_64 under QEMU, CONFIG_KASAN=y, 4 CPUs, base 2f0c1cf72f46.  A compatible
histogram on sched_waking keyed on WK, an onmatch() target on sched_switch
keyed on SK, my_synth($wakeup_lat,prio) forcing a field variable.

Donggeun Yoo (2):
  tracing: Add the bucket size to expr_field_str()
  tracing: Fix NULL dereference when copying keys for a field variable

 kernel/trace/trace_events_hist.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

-- 
2.53.0