From: Zafir Rasyidi Taufik <[email protected]> Syzbot reported a slab use-after-free read in uprobe_mmap. The root cause is when a trace_probe has a sibling event, unregister_trace_uprobe() does not unlink &tu->consumer. This memory can still be referenced in multiple locations, namely filter_chain and uprobe_mmap, resulting in a use-after-free. This is not a security issue as creating uprobes requires CAP_SYS_ADMIN.
Here's a short repro in bash which will trigger a KASAN report, tested on v7.2.4. Note the offsets used for /bin/true may need some adjusting, they are the offset of its entrypoint in this example: ``` echo "p:uprobe_test/evS /bin/true:0x23d0" >> /sys/kernel/tracing/uprobe_events echo "p:uprobe_test/evS /bin/true:0x23d4" >> /sys/kernel/tracing/uprobe_events echo 1 > /sys/kernel/tracing/events/uprobe_test/evS/enable echo "-:uprobe_test/evS" >> /sys/kernel/tracing/uprobe_events /bin/true ``` I originally reported this to the perf maintainers (because of tag by syzbot) but I should've reported it here instead. Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=1340ad4350ad43394c10 Signed-off-by: Zafir Rasyidi Taufik <[email protected]> Assisted-by: Deepseek v4 Flash --- kernel/trace/trace_uprobe.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index c274346853d1..8738c46a6ebf 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c @@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu) return ret; unreg: + if (tu->uprobe) { + uprobe_unregister_nosync(tu->uprobe, &tu->consumer); + tu->uprobe = NULL; + uprobe_unregister_sync(); + } dyn_event_remove(&tu->devent); trace_probe_unlink(&tu->tp); free_trace_uprobe(tu); -- 2.43.0
