Tengda Wu
42561fe62c
tracing: Fix use-after-free in print_graph_function_flags during tracer switching ...
commit 7f81f27b1093e4895e87b74143c59c055c3b1906 upstream.
Kairui reported a UAF issue in print_graph_function_flags() during
ftrace stress testing [1]. This issue can be reproduced if puting a
'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(),
and executing the following script:
$ echo function_graph > current_tracer
$ cat trace > /dev/null &
$ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point
$ echo timerlat > current_tracer
The root cause lies in the two calls to print_graph_function_flags
within print_trace_line during each s_show():
* One through 'iter->trace->print_line()';
* Another through 'event->funcs->trace()', which is hidden in
print_trace_fmt() before print_trace_line returns.
Tracer switching only updates the former, while the latter continues
to use the print_line function of the old tracer, which in the script
above is print_graph_function_flags.
Moreover, when switching from the 'function_graph' tracer to the
'timerlat' tracer, s_start only calls graph_trace_close of the
'function_graph' tracer to free 'iter->private', but does not set
it to NULL. This provides an opportunity for 'event->funcs->trace()'
to use an invalid 'iter->private'.
To fix this issue, set 'iter->private' to NULL immediately after
freeing it in graph_trace_close(), ensuring that an invalid pointer
is not passed to other tracers. Additionally, clean up the unnecessary
'iter->private = NULL' during each 'cat trace' when using wakeup and
irqsoff tracers.
[1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Zheng Yejian <zhengyejian1@huawei.com>
Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com
Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace")
Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM06fxw@mail.gmail.com/
Reported-by: Kairui Song <kasong@tencent.com>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-04-10 14:29:43 +02:00
bpf: fix potential error return
2025-01-09 13:23:36 +01:00
cgroup: Make operations on the cgroup root_list RCU safe
2024-12-14 19:44:35 +01:00
kdb: Use the passed prompt in kdb_position_cursor()
2024-08-19 05:33:40 +02:00
dma: fix call order in dmam_free_coherent
2024-08-19 05:33:41 +02:00
perf/ring_buffer: Allow the EPOLLRDNORM flag for poll
2025-04-10 14:29:40 +02:00
gcov: add support for GCC 14
2024-07-05 09:08:24 +02:00
genirq/irqdesc: Honor caller provided affinity in alloc_desc()
2024-08-19 05:33:52 +02:00
livepatch: fix race between fork and KLP transition
2022-10-26 13:22:18 +02:00
locking/semaphore: Use wake_q to wake up processes outside lock critical section
2025-04-10 14:29:42 +02:00
PM: hibernate: Add error handling for syscore_suspend()
2025-03-13 12:42:59 +01:00
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
2025-03-13 12:43:02 +01:00
rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
2024-07-05 09:08:20 +02:00
sched/deadline: Use online cpus for validating runtime
2025-04-10 14:29:42 +02:00
hrtimers: Mark is_migration_base() with __always_inline
2025-04-10 14:29:36 +02:00
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
2025-04-10 14:29:43 +02:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
acct: perform last write from workqueue
2025-03-13 12:43:26 +01:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
audit: Send netlink ACK before setting connection in auditd_set
2024-02-23 08:24:54 +01:00
audit: log AUDIT_TIME_* records only from rules
2022-04-15 14:18:04 +02:00
audit: fix potential double free on error path from fsnotify_add_inode_mark
2022-09-05 10:27:38 +02:00
audit: move put_tree() to avoid trim_trees refcount underflow and UAF
2021-09-03 10:08:16 +02:00
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
2023-11-28 16:50:18 +00:00
audit: fix a net reference leak in audit_list_rules_send()
2020-06-22 09:30:59 +02:00
audit: fix possible soft lockup in __audit_inode_child()
2023-09-23 10:59:46 +02:00
treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
2023-04-20 12:07:32 +02:00
bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS
2024-05-02 16:18:37 +02:00
sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
2023-04-05 11:16:42 +02:00
kernel/configs: Replace GPL boilerplate code with SPDX identifier
2019-07-30 18:34:15 +02:00
hrtimers: Handle CPU state correctly on hotplug
2025-02-01 18:18:51 +01:00
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-22 09:31:22 +02:00
cred: switch to using atomic_long_t
2023-12-20 15:41:18 +01:00
mm: optimize the redundant loop of mm_update_owner_next()
2024-07-18 11:40:51 +02:00
kernel/extable.c: use address-of operator on section symbols
2023-06-09 10:29:01 +02:00
kernel/fail_function: fix memory leak with using debugfs_lookup()
2023-03-11 16:44:15 +01:00
kernel/fork: beware of __put_task_struct() calling context
2023-09-23 11:00:03 +02:00
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
kheaders: Ignore silly-rename files
2025-02-01 18:18:51 +01:00
mm/nvdimm: add is_ioremap_addr and use that to check ioremap address
2019-07-12 11:05:40 -07:00
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
sched/rt, Kconfig: Unbreak def/oldconfig with CONFIG_PREEMPT=y
2019-07-22 18:05:11 +02:00
kexec_load: Disable at runtime if the kernel is locked down
2019-08-19 21:54:15 -07:00
kexec: fix a memory leak in crash_shrink_memory()
2023-07-27 08:37:10 +02:00
kexec: initialize ELF lowest address to ULONG_MAX
2025-04-10 14:29:41 +02:00
kexec: support purgatories with .text.hot sections
2023-06-21 15:44:10 +02:00
kheaders: Use array declaration instead of char
2023-05-17 11:35:33 +02:00
kmod: make request_module() return an error when autoloading is disabled
2020-04-17 10:50:22 +02:00
kprobes: Fix possible use-after-free issue on kprobe registration
2024-05-02 16:18:30 +02:00
kthread: fix task state in kthread worker if being frozen
2024-11-08 16:20:30 +01:00
kbuild: update config_data.gz only when the content of .config is changed
2021-05-11 14:04:16 +02:00
modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
2023-09-23 10:59:36 +02:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
module: harden ELF info handling
2021-04-07 14:47:38 +02:00
kernel/notifier.c: intercept duplicate registrations to avoid infinite loops
2020-10-01 13:17:23 +02:00
padata: fix sysfs store callback check
2025-03-13 12:42:56 +01:00
panic: Flush kernel log buffer at the end
2024-04-13 12:51:37 +02:00
params: lift param_set_uint_minmax to common code
2024-06-16 13:28:45 +02:00
kernel/pid.c: convert struct pid count to refcount_t
2019-07-16 19:23:24 -07:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 12:26:37 +02:00
profiling: fix shift too large makes kernel panic
2022-08-25 11:18:02 +02:00
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 18:11:24 +02:00
kernel/reboot: emergency_restart: Set correct system_state
2023-11-28 16:50:19 +00:00
relayfs: fix out-of-bounds access in relay_file_read
2023-05-17 11:35:58 +02:00
resource: fix region_intersects() vs add_memory_driver_managed()
2024-11-08 16:20:46 +01:00
seccomp: Invalidate seccomp mode to catch death failures
2022-02-16 12:52:53 +01:00
signal: Replace BUG_ON()s
2024-11-08 16:20:38 +01:00
smp: Add missing destroy_work_on_stack() call in smp_call_on_cpu()
2024-09-12 11:03:54 +02:00
kthread: Extract KTHREAD_IS_PER_CPU
2021-02-07 15:35:49 +01:00
tasklet: Introduce new initialization API
2025-03-13 12:43:04 +01:00
stacktrace: Don't skip first entry on noncurrent tasks
2019-11-04 21:19:25 +01:00
stop_machine: Avoid potential race behaviour
2019-10-17 12:47:12 +02:00
getrusage: use sig->stats_lock rather than lock_task_sighand()
2024-03-15 10:48:19 -04:00
kernel/sys_ni: add compat entry for fadvise64_64
2022-09-05 10:27:38 +02:00
kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()
2020-10-01 13:17:10 +02:00
sched/rt: Disallow writing invalid values to sched_rt_period_us
2024-03-01 13:13:33 +01:00
taskstats: fix data-race
2020-01-09 10:19:54 +01:00
torture: Remove exporting of internal functions
2019-08-01 14:30:22 -07:00
tracepoint: Add tracepoint_probe_register_may_exist() for BPF tracing
2021-07-14 16:53:08 +02:00
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:59:57 +01:00
proc/sysctl: add shared variables for range check
2019-07-18 17:08:07 -07:00
usermodehelper: reset umask to default before executing user process
2020-10-14 10:32:58 +02:00
smp: Fix smp_call_function_single_async prototype
2021-05-14 09:44:33 +02:00
watchdog: export lockup_detector_reconfigure
2022-08-25 11:18:37 +02:00
watchdog/perf: properly initialize the turbo mode timestamp and rearm counter
2024-08-19 05:33:39 +02:00
workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
2023-10-25 11:53:18 +02:00
42561fe62c