On Thu, Sep 10, 2026 at 02:48:49AM +0000, [email protected] wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > > Pre-existing issues: > - [Critical] Race condition in unregister_trace_uprobe leads to > use-after-free (UAF) of trace_uprobe during lockless read accesses. > -- > > commit 04fcafa318e6d04f74e677950139db1dd3bf079c > Author: Zafir Rasyidi Taufik <[email protected]> > > tracing: uprobes: Fix slab use-after-free in filter_chain > > This commit addresses a use-after-free in uprobe_mmap. It resolves an issue > where unregister_trace_uprobe() would fail to unlink the consumer when a > trace_probe has a sibling event. > > > diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c > > index 861d857adadb3..110ec7b78b3dc 100644 > > --- a/kernel/trace/trace_uprobe.c > > +++ b/kernel/trace/trace_uprobe.c > > @@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe > > *tu) > > return ret; > > > > unreg: > > + if (tu->uprobe) { > > + uprobe_unregister_nosync(tu->uprobe, &tu->consumer); > > + tu->uprobe = NULL; > > + uprobe_unregister_sync(); > > + } > > dyn_event_remove(&tu->devent); > > trace_probe_unlink(&tu->tp); > > free_trace_uprobe(tu); > > [Severity: Critical] > This is a pre-existing issue, but does this code leave a window for a > use-after-free of trace_uprobe during lockless read accesses? > > When a sibling probe exists, this code unlinks and immediately frees the > trace probe without synchronizing with trace readers via RCU or shared locks. > > For example, when a user queries an attached perf event, it initiates a > lockless traversal: > > bpf_task_fd_query() > bpf_get_perf_event_info() > bpf_get_uprobe_info() > trace_uprobe_primary_from_call() > > This accesses the trace probe structure without acquiring event_mutex or > trace_event_sem. > > Additionally, even if trace_event_sem is held for read, such as during > print_uprobe_event(), unregister_trace_uprobe() bypasses taking > trace_event_sem for write when unregistering a sibling probe (it skips > unregister_uprobe_event() and jumps directly to unreg). > > At the same time, if unregister_trace_uprobe() is called, it unlinks the > probe via trace_probe_unlink(). The list removal relies on standard > list_del_init() instead of list_del_rcu(), allowing concurrent lockless > readers to traverse into soon-to-be-freed nodes when free_trace_uprobe(tu) > is called immediately after. > > Could this lead to memory corruption when readers access the freed probe?
I will investigate furthur regarding this. If it's correct I will think of a patch and send it separately. > > -- > Sashiko AI review ยท > https://sashiko.dev/#/patchset/[email protected]?part=1
