github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-12 20:53:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tracing/probes: Fix use-after-free on field name/type of events with multiple probes

Browse Source 
The fields of a probe-based dynamic event (kprobe, uprobe, eprobe and
fprobe events) are created in traceprobe_define_arg_fields() by handing
the probe_arg name/type strings to trace_define_field(), which only
stores the pointers without copying. Those strings are owned by the
trace_probe and are freed when that probe is removed.

An event can have several probes attached. The field list is defined
only once, by the first probe that registers the event, but it is kept
alive by any surviving sibling probe. Deleting just that first probe by
symbol -

  # primary A: fields are defined from A's args
  echo 'p:kprobes/ev vfs_read  a1=$arg1' >  kprobe_events
  # append B: shares A's event call
  echo 'p:kprobes/ev vfs_write a1=$arg1' >> kprobe_events
  # delete only A (matched by symbol), B survives
  echo '-:kprobes/ev vfs_read'           >> kprobe_events

frees A's args (trace_probe_cleanup() -> traceprobe_free_probe_arg()),
but trace_probe_unlink() keeps the trace_probe_event because the probe
list is not empty. The event call stays registered via B while its
fields now reference freed memory. Any field lookup then reads it, e.g.

  echo 'a1 == 1' > events/kprobes/ev/filter

  BUG: KASAN: slab-use-after-free in strcmp+0xa7/0xb0
  Call Trace:
   strcmp
   trace_find_event_field
   parse_pred
   process_preds
   create_filter
   apply_event_filter
   event_filter_write

field->name references parg->name (kstrdup'd, freed with the probe) and,
for array arguments, field->type references parg->fmt (kmalloc'd, freed
with the probe) - the scalar type otherwise points at the static
fmttype rodata, which is safe.

Have traceprobe_define_arg_fields() duplicate the name and type strings
and anchor the copies on the trace_probe_event, which embeds the event
call and outlives every individual probe; trace_probe_event_free()
releases them.

The reproducer above triggers reliably; the field lookup and the delete
both run under event_mutex, so this is a dangling reference after
removal rather than a race.

The issue was found by the autokbug dynamic kernel fuzzer at Tencent
Yunding Lab.

Link: https://lore.kernel.org/all/20260826030009.1855331-1-bsdhenrymartin@gmail.com/

Fixes: ca89bc071d ("tracing/kprobe: Add multi-probe per event support")
Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
This commit is contained in:
Henry Martin 2026-08-26 11:00:09 +08:00 committed by Masami Hiramatsu (Google)
parent 871e07b6e3
commit 86b7a239ec
2 changed files with 49 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
kernel/trace/trace_probe.c
View File

@ -2553,19 +2553,60 @@ int traceprobe_set_print_fmt(struct trace_probe *tp, enum probe_print_type ptype
int traceprobe_define_arg_fields(struct trace_event_call *event_call,
size_t offset, struct trace_probe *tp)
{
struct trace_probe_event *tpe = trace_probe_event_from_call(event_call);
int ret, i;
/*
* A field created by trace_define_field() only stores the name and
* type pointers, it does not copy the strings. Here they point into
* the probe_arg of @tp, which is freed when @tp is removed. For an
* event with multiple probes attached, the field list is defined
* once by the first probe but kept alive by the surviving siblings,
* so removing that first probe would leave the fields referencing
* freed memory. Duplicate the strings and anchor the copies on the
* trace_probe_event, which lives as long as the field list itself.
*
* event_define_fields() ignores the return value of this hook, so
* if a previous attempt failed before creating any field, it may
* call here again. Release duplicates left behind by such an
* attempt before starting over.
*/
for (i = 0; i < tpe->nr_field_strings; i++)
kfree(tpe->field_strings[i]);
kfree(tpe->field_strings);
tpe->field_strings = NULL;
tpe->nr_field_strings = 0;
if (tp->nr_args) {
tpe->field_strings = kcalloc(tp->nr_args * 2, sizeof(char *),
GFP_KERNEL);
if (!tpe->field_strings)
return -ENOMEM;
}
/* Set argument names as fields */
for (i = 0; i < tp->nr_args; i++) {
struct probe_arg *parg = &tp->args[i];
const char *fmt = parg->type->fmttype;
int size = parg->type->size;
char *name, *type;
if (parg->fmt)
fmt = parg->fmt;
if (parg->count)
size *= parg->count;
ret = trace_define_field(event_call, fmt, parg->name,
name = kstrdup(parg->name, GFP_KERNEL);
type = kstrdup(fmt, GFP_KERNEL);
if (!name || !type) {
kfree(name);
kfree(type);
return -ENOMEM;
}
tpe->field_strings[tpe->nr_field_strings++] = name;
tpe->field_strings[tpe->nr_field_strings++] = type;
ret = trace_define_field(event_call, type, name,
offset + parg->offset, size,
parg->type->is_signed,
FILTER_OTHER);
@ -2577,6 +2618,11 @@ int traceprobe_define_arg_fields(struct trace_event_call *event_call,
static void trace_probe_event_free(struct trace_probe_event *tpe)
{
int i;
for (i = 0; i < tpe->nr_field_strings; i++)
kfree(tpe->field_strings[i]);
kfree(tpe->field_strings);
kfree(tpe->class.system);
kfree(tpe->call.name);
kfree(tpe->call.print_fmt);

2
kernel/trace/trace_probe.h
View File

@ -264,6 +264,8 @@ struct trace_probe_event {
struct trace_event_call call;
struct list_head files;
struct list_head probes;
char **field_strings;
int nr_field_strings;
struct trace_uprobe_filter filter[];
};