User events keep per-mm tracing state in task_struct::user_event_mm. It
tracks the registrations and enablers created through the tracefs
user_events_data interface.
dup_task_struct() starts a fork by copying this pointer from the parent.
user_events_fork() must then either share it for CLONE_VM, or create new
state for a child with a separate address space.
The second case can fail. If user_event_mm_dup() cannot allocate the new
state or copy one of its enablers, it returns without replacing the
pointer copied by dup_task_struct(). The child now points at the parent's
tracing state, but did not take a task reference to it.
When the child exits, user_event_mm_remove() can drop the parent's task
count to zero and queue its tracing state for release. The next
user-events registration in the parent calls current_user_event_mm() and
writes to the freed object.
KASAN reports:
BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0
Write of size 4 at addr ffff888005010d30 by task init/44
Call Trace:
<TASK>
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
current_user_event_mm+0x51/0x1d0
user_events_ioctl+0x82e/0x15c0
__x64_sys_ioctl+0x139/0x1c0
do_syscall_64+0xce/0x450
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 44:
__kasan_kmalloc+0x8f/0xa0
__kmalloc_cache_noprof+0x180/0x3a0
user_event_mm_alloc+0x3c/0x1f0
current_user_event_mm+0x88/0x1d0
Freed by task 42:
__kasan_slab_free+0x43/0x70
kfree+0x13a/0x390
process_one_work+0x696/0xf90
worker_thread+0x420/0xba0
Clear the child's copied user_event_mm before starting the fallible
duplication. If duplication fails, the child has no user-events tracing
state to release. The CLONE_VM case remains unchanged because
user_events_fork() explicitly installs the shared pointer and increments
its task count.
Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event
enablement")
Assisted-by: Codex:gpt-daybreak-blue
Signed-off-by: Jérémy Jean <[email protected]>
---
include/linux/user_events.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/include/linux/user_events.h b/include/linux/user_events.h
index 57d1ff0..2c9ac7b 100644
--- a/include/linux/user_events.h
+++ b/include/linux/user_events.h
@@ -48,6 +48,7 @@ static inline void user_events_fork(struct task_struct *t,
return;
}
+ t->user_event_mm = NULL;
user_event_mm_dup(t, old_mm);
}
--
2.47.3
