Re: [PATCH] tracing: hist: let values keep the percent and graph modifiers

On Mon, Sep 07, 2026 at 05:31:12AM +0000, sashiko-bot@kernel.org wrote:

[Critical] Out-of-bounds loop and invalid pointer free in
tracing_map_destroy_sort_entries when stats allocation fails.

Confirmed, including the reachability the report points at: this patch is
what makes that path live again.

Reproduced with the stats allocation forced to fail, reading the hist file
of a trigger with a .percent value:

  BUG: KASAN: vmalloc-out-of-bounds in tracing_map_destroy_sort_entries+0xa0/0xb0
  Read of size 8 at addr ffffc90000045000 by task init/1
   tracing_map_destroy_sort_entries+0xa0/0xb0
   hist_show+0x6f7/0x1df0
   seq_read_iter+0x2b8/0x1190
   vfs_read+0x176/0xa40

followed by a fatal page fault a few pages further. The registers at the
oops give the bound: the loop's end pointer less the array start, over the
pointer size, is 4294967284, which is -ENOMEM as an unsigned int.

Fix sent, with Cc: stable and a note that it should be applied before this
one:

  https://lore.kernel.org/linux-trace-kernel/20260907060323.480728-1-donggeunyoo.kernel@gmail.com/ (local)