This is a bug report, not a patch submission.
We found a bug reachable in:
path trace/trace_events_user.c`, `kernel/trace
crash use-after-free in trace_event_probe_cleanup()
commit 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
Config, environment, the sanitizer report and a C reproducer follow.
== Notes ===============================================================
If you fix this bug, this tag credits the report and lets us
close it on our side:
Reported-by: [email protected]
Everything in this mail is validated by the reproducer below.
We also hold an unreviewed LLM-generated analysis and candidate
patch. The same reproducer panics the unpatched kernel and runs
clean with that patch applied. Use it as a starting point, or ignore
it and write your own:
patch.diff https://bugs.sh/b/832991690fed76cd/patch.diff
report.md https://bugs.sh/b/832991690fed76cd/report.md
A guide to taking it from here to a sendable patch, including the
trailers to add: https://bugs.sh/patch.html
Happy to test patches. Complaints and suggestions about our work
are welcome at:
[email protected]
== Environment =========================================================
Reproduced on 2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
VM setup https://bugs.sh/b/832991690fed76cd/run.sh
config https://bugs.sh/b/832991690fed76cd/config.gz
poc https://bugs.sh/b/832991690fed76cd/repro.c
== Sanitizer Report ====================================================
BUG: KASAN: slab-use-after-free in trace_event_probe_cleanup.part.0
(./include/linux/trace_events.h:430 kernel/trace/trace_eprobe.c:59)
Read of size 4 at addr ffff8880137e64a8 by task exploit/144
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
trace_event_probe_cleanup.part.0 (./include/linux/trace_events.h:430
kernel/trace/trace_eprobe.c:59)
eprobe_dyn_event_release (kernel/trace/trace_eprobe.c:53
kernel/trace/trace_eprobe.c:120)
dyn_event_release (kernel/trace/trace_dynevent.c:110)
trace_parse_run_command (kernel/trace/trace.c:9565)
vfs_write (fs/read_write.c:685)
ksys_write (fs/read_write.c:739)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Allocated by task 147:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_cache_noprof (./include/linux/kasan.h:263 mm/slub.c:5489)
user_event_parse_cmd (./include/linux/slab.h:988 ./include/linux/slab.h:1309
kernel/trace/trace_events_user.c:2133 kernel/trace/trace_events_user.c:1035)
user_events_ioctl (kernel/trace/trace_events_user.c:2508
kernel/trace/trace_events_user.c:2703)
__x64_sys_ioctl (fs/ioctl.c:51 fs/ioctl.c:597 fs/ioctl.c:583 fs/ioctl.c:583)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Freed by task 74:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:584)
__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
destroy_user_event.part.0 (kernel/trace/trace_events_user.c:1525)
delayed_destroy_user_event (kernel/trace/trace_events_user.c:262
kernel/trace/trace_events_user.c:251)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Last potentially related work creation:
kasan_save_stack (mm/kasan/common.c:57)
kasan_record_aux_stack (mm/kasan/generic.c:556)
insert_work (kernel/workqueue.c:2226)
__queue_work (kernel/workqueue.c:2401)
queue_work_on (kernel/workqueue.c:2452)
user_event_put (./include/linux/workqueue.h:699 ./include/linux/workqueue.h:760
kernel/trace/trace_events_user.c:327 kernel/trace/trace_events_user.c:265)
delayed_user_event_enabler_put (kernel/trace/trace_events_user.c:408)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address belongs to the object at ffff8880137e6400
which belongs to the cache kmalloc-cg-512 of size 512
The buggy address is located 168 bytes inside of
freed 512-byte region [ffff8880137e6400, ffff8880137e6600)
---
The report format is based on syzbot bug report.
This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.
For any issue with this report, reach out to [email protected]
If the report is already addressed, let us know by replying with:
#co fix: <commit hash>
If the report is a duplicate of another one, reply with:
#co dup: <lore link>
If you want to undo deduplication, reply with:
#co undup
