On 24 August 2026 22:10:37 BST, "Jérémy Jean" <[email protected]> wrote: >User events keep per-mm tracing state in task_struct::user_event_mm. It >tracks the registrations and enablers created through the tracefs >user_events_data interface. > >dup_task_struct() starts a fork by copying this pointer from the parent. >user_events_fork() must then either share it for CLONE_VM, or create new >state for a child with a separate address space. > >The second case can fail. If user_event_mm_dup() cannot allocate the new >state or copy one of its enablers, it returns without replacing the >pointer copied by dup_task_struct(). The child now points at the parent's >tracing state, but did not take a task reference to it. > >When the child exits, user_event_mm_remove() can drop the parent's task >count to zero and queue its tracing state for release. The next >user-events registration in the parent calls current_user_event_mm() and >writes to the freed object. > >KASAN reports: > > BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0 > Write of size 4 at addr ffff888005010d30 by task init/44 > > Call Trace: > <TASK> > kasan_report+0xce/0x100 > kasan_check_range+0x10f/0x1e0 > current_user_event_mm+0x51/0x1d0 > user_events_ioctl+0x82e/0x15c0 > __x64_sys_ioctl+0x139/0x1c0 > do_syscall_64+0xce/0x450 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Allocated by task 44: > __kasan_kmalloc+0x8f/0xa0 > __kmalloc_cache_noprof+0x180/0x3a0 > user_event_mm_alloc+0x3c/0x1f0 > current_user_event_mm+0x88/0x1d0 > > Freed by task 42: > __kasan_slab_free+0x43/0x70 > kfree+0x13a/0x390 > process_one_work+0x696/0xf90 > worker_thread+0x420/0xba0 > >Clear the child's copied user_event_mm before starting the fallible >duplication. If duplication fails, the child has no user-events tracing >state to release. The CLONE_VM case remains unchanged because >user_events_fork() explicitly installs the shared pointer and increments >its task count. > >Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event >enablement") >Assisted-by: Codex:gpt-daybreak-blue >Signed-off-by: Jérémy Jean <[email protected]> >--- > include/linux/user_events.h | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/include/linux/user_events.h b/include/linux/user_events.h >index 57d1ff0..2c9ac7b 100644 >--- a/include/linux/user_events.h >+++ b/include/linux/user_events.h >@@ -48,6 +48,7 @@ static inline void user_events_fork(struct task_struct *t, > return; > } > >+ t->user_event_mm = NULL;
I had a think about this, I really feel this is okay. Knowing me, I made a mistake. Hmmm. Should I do tag? well.. this can't be wrong, it's a one liner, and a acceptable fix for a bug. okay, guess this works. Reviewed-by: Bradley Morgan <[email protected]> Comment?, wait, no not really needed. Its small, and easy (Sorry, I think Out loud sometimes) > user_event_mm_dup(t, old_mm); > } > > Thanks!
