tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

[PATCH] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Posted by Deepanshu Kartikey 1 month, 1 week ago

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
which frees every sub-buffer of the ring buffer, including the reader
page, and replaces them with newly allocated ones.

Readers of trace_pipe hold pointers into those pages. ring_buffer_peek()
looks up an event under cpu_buffer->reader_lock but returns the event
pointer after dropping the lock, and peek_next_entry() then calls
ring_buffer_event_length() and ring_buffer_event_data() on it. If the
sub-buffer order is changed in that window, the reader dereferences
freed memory:

  BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430
  Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002

  Freed by:
   free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
   ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
   buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221

Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change.
This is the lock trace_pipe readers already hold across their entire
peek-and-print loop, so the swap can no longer race with a reader that
is dereferencing a peeked event.

Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2
Tested-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 kernel/trace/trace.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 395238b2b715..c38a5de602e0 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8214,6 +8214,8 @@ buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
 	/* Do not allow tracing while changing the order of the ring buffer */
 	tracing_stop_tr(tr);
 
+	trace_access_lock(RING_BUFFER_ALL_CPUS);
+
 	old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
 	if (old_order == order)
 		goto out;
@@ -8253,6 +8255,7 @@ buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
 #endif
 	(*ppos)++;
  out:
+	trace_access_unlock(RING_BUFFER_ALL_CPUS);
 	if (ret)
 		cnt = ret;
 	tracing_start_tr(tr);
-- 
2.43.0

Re: [PATCH] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Posted by Deepanshu Kartikey 1 month ago

On Mon, Aug 17, 2026 at 7:37 PM Deepanshu Kartikey
<kartikey406@gmail.com> wrote:
>
> Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),
> which frees every sub-buffer of the ring buffer, including the reader
> page, and replaces them with newly allocated ones.
>
> Readers of trace_pipe hold pointers into those pages. ring_buffer_peek()
> looks up an event under cpu_buffer->reader_lock but returns the event
> pointer after dropping the lock, and peek_next_entry() then calls
> ring_buffer_event_length() and ring_buffer_event_data() on it. If the
> sub-buffer order is changed in that window, the reader dereferences
> freed memory:
>
>   BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430
>   Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
>
>   Freed by:
>    free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
>    ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
>    buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
>
> Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change.
> This is the lock trace_pipe readers already hold across their entire
> peek-and-print loop, so the swap can no longer race with a reader that
> is dereferencing a peeked event.
>
> Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
> Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2
> Tested-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  kernel/trace/trace.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 395238b2b715..c38a5de602e0 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -8214,6 +8214,8 @@ buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
>         /* Do not allow tracing while changing the order of the ring buffer */
>         tracing_stop_tr(tr);
>
> +       trace_access_lock(RING_BUFFER_ALL_CPUS);
> +
>         old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
>         if (old_order == order)
>                 goto out;
> @@ -8253,6 +8255,7 @@ buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
>  #endif
>         (*ppos)++;
>   out:
> +       trace_access_unlock(RING_BUFFER_ALL_CPUS);
>         if (ret)
>                 cnt = ret;
>         tracing_start_tr(tr);
> --
> 2.43.0
>

Gentle Reminder. Please let me know the status of this patch

Thanks

Deepanshu

Re: [PATCH] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Posted by Steven Rostedt 1 month ago

On Tue, 25 Aug 2026 06:58:29 +0530
Deepanshu Kartikey <kartikey406@gmail.com> wrote:

> On Mon, Aug 17, 2026 at 7:37 PM Deepanshu Kartikey

You just sent this 6 days ago, and you likely got my out-of-office
message.

> <kartikey406@gmail.com> wrote:

> 
> Gentle Reminder. Please let me know the status of this patch

Check patchwork for status:

  https://patchwork.kernel.org/project/linux-trace-kernel/patch/20260817140655.5694-1-kartikey406@gmail.com/

-- Steve