Re: [PATCH 2/2] perf, ftrace: Fix use-after-free in __ftrace_ops_list_func()

On Wed, 24 Mar 2021 21:11:23 -0400 Steven Rostedt wrote: > And what you are saying is that we are not getting there, where the > dynamically allocated perf ops is not set to be DYNAMIC? > > That should be set as DYNAMIC if the ops was allocated, and can later > be freed. This code was written

Re: [PATCH 2/2] perf, ftrace: Fix use-after-free in __ftrace_ops_list_func()

On Wed, 17 Mar 2021 18:25:29 +0800 Li Huafei wrote: > We see the comment of ftrace_ops in include/linux/ftrace.h, which > actually mentions that for dynamically allocated ftrace_ops, after > unregistering it should be guaranteed that no user will reference that > ftrace_ops again, but the

[PATCH 2/2] perf, ftrace: Fix use-after-free in __ftrace_ops_list_func()

We got a use-after-free report when doing kernel fuzz tests with KSSAN turned on: [ 1367.884099] BUG: KASAN: use-after-free in ftrace_ops_list_func+0xf7/0x220 [ 1367.885153] Read of size 8 at addr 8884f81a47d0 by tasksyz-executor/99086 [ 1367.886517] CPU: 2 PID: 99086 Comm: syz-executor