From nobody Mon Sep 28 09:59:41 2026 Received: from mail-oa2-f1.google.com (mail-oa2-f1.google.com [74.125.231.65]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65B8A314D1A for ; Mon, 24 Aug 2026 07:10:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.231.65 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787555427; cv=none; b=jiQxc9TG/160XN9B9x3zQDaevBEozg3i2uzrYptYL9nTPHbo53pwshzRxEhgDgiKv0VoDoSpKE6FBbK/fIP295/aScT0ZJq45lretjcp4osm3eFfgpXPqP+ix1FExtd0cSsQg5QZEg/N/5V3We/SSFmdGuM+b/o3s1wk5HuX2YQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787555427; c=relaxed/simple; bh=YhspMydTY1oA24IJ6JLVdGCBzKlQDhp++E1WO+31lMA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=qZO3wSkcCzGuTcdVvW84CvSnzC/Tx65sRnOvHygENBtCmMf50RMBVkhDWTM2qaV+eqNqDy70gKSMPXeyl/8NKkPbj2mgzVuEx1S0lvvCwQSX3zaZiDwTnvdHOhA3Xo2mVwpvJuCIQvIaRzC+/zmSsjMnDIYDfb9Jrwh9lql2X50= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YebJa11I; arc=none smtp.client-ip=74.125.231.65 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YebJa11I" Received: by mail-oa2-f1.google.com with SMTP id 586e51a60fabf-4489b7aa0e7so850692fac.1 for ; Mon, 24 Aug 2026 00:10:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787555425; x=1788160225; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=O3IzVHIXrBFOM86OhJWc9RtLmRZBPf8cDlCfPztlzHM=; b=YebJa11INEo+P/O0cIfylr7FUxEu6gyhwFS2AqjtgSaVbeipSRCln5hF/0qvV2WnmO LOYZ3C88A7HmA35WW1Na8bpNCrr81S5SNxpN2PrzwZroh8LW75xFn5brB4aOpWC3mlVl 0YJ2d7JTLjoLgzvxcdHTjn5imehbn70TwQ6GDm4foYReHnUQ+ZdVMhwoRe0VHU+lZ+ks P9c2Z7s40ONGcgTyOdo8XqAR+Cwiwe+dTaom02iiX5LSPcmwoewgOnIBELrVwqW1Ng1A 2nEtK/q1hE+TvArWFolggzdqBqrvEclnZXEE5L1WIxOxoJh2tTgJCf5WTq+OqHEs6i/e VH7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787555425; x=1788160225; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=O3IzVHIXrBFOM86OhJWc9RtLmRZBPf8cDlCfPztlzHM=; b=BLwtF73upxZa+AkjN1ttY2zIadQn7DiFs3hD0amlW+N50d9MIKBf+I8VLK8pKDWIDU 2UYa92LFmWfe2/1BQ654Ilsv0tZMkQnbt6eZuwgrUSmWytiiRZZ3IUHK1+riNrnIi1uk ROU5KVG4lSog7xQT/tIZtdPO7I7L8RxiDine6vGRPL/bVWkt0L8WpKiybnujUZbtpL6x ySPTWbA7jwAVNmkpTjR+QjglJVln8iP8m6nTdIy0iibnUhOix9WLWsppuMexIzHU3IcZ 5LxAG9fdQnmn9Eu3zDDNZmwaleFBdskaj0y/EnBzgw3mrml5IMdKol6OERHpwpfk4fUe nuCQ== X-Forwarded-Encrypted: i=1; AHgh+Ro8dt1mHUgJf8udIuPZ2+Oafn8AmpchWc1SYaUgVsqw88LBwYYWogJzoAgS9NDaGhYvYmMMqvNldBPKdfk=@vger.kernel.org X-Gm-Message-State: AFuF++k0kVct2uyLYEjJh1yA5jZNbrGlTThDL+we3xjSlbfnZwMNo5Tr 8rNZ2pL4dJfoO+bVpmfG7Pvqre1d9rxghlWwScIlSYLXa6V6U6hP/COc X-Gm-Gg: AR+sD12tKJDbktvRo5vnoFyep8kVTIsPEzU5AZ6b9DvYh0ZT4qC2IWg+TcucyHxpxka YZGCdTrFR1+EKuLJ0tRLiDyd7qxLjpdsjJhKto+FQWpUTIBA52yDKkOnDWDX4gJq9xxqyCCYFLs hwQUwvgyNrA2rNI/4M29/8J6CtlrJAkeVZ+rn9jp09iQ04n7UkVJaLsFChm1T89vxMf/cHuuIce 8xq2QT84JgLbr1ixEQcOO4Q+2RV7lVgYD6YMNFLIf/he3Tr0oayJjjTp9G9B/857hu4L9UX5HUw /zD0FQ/qI/SzpUj8FYDScWU+PFct9hFQNQsYJfBdg0nKqH8CnmYP7Q78n5yHjE3qBObVyL3hpRj MZFUnxD6EeScBgPMwkSwdyg9CuGbsDVf/wlAk25HX5ypIILPOOHZ0ypsNgl7/uEX4FDfh3eMfd+ paRAEGOmUYePG7dRwHBdEG0u3RawZJZVDIutqxq6njYFv23L2m5H2YiBf6YD95Tl3ne/PfbRyZz ooZsyElB7dXc1J3NpyG+LUsrleL/xGaN5L/ X-Received: by 2002:a05:6870:f290:b0:456:f700:dd75 with SMTP id 586e51a60fabf-4637fa674admr15809304fac.7.1787555425264; Mon, 24 Aug 2026 00:10:25 -0700 (PDT) Received: from localhost.localdomain ([14.22.11.164]) by smtp.gmail.com with ESMTPSA id 586e51a60fabf-46383499862sm5024219fac.9.2026.08.24.00.10.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 00:10:24 -0700 (PDT) From: Henry Martin To: Steven Rostedt , Masami Hiramatsu Cc: Mathieu Desnoyers , linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Henry Martin Subject: [PATCH] tracing: Fix use-after-free on field name/type of dynamic probe events Date: Mon, 24 Aug 2026 15:10:11 +0800 Message-ID: <20260824071011.3507735-1-bsdhenrymartin@gmail.com> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fields of a probe-based dynamic event (kprobe, uprobe and eprobe events) are created from the argument name and type strings of the trace_probe that first registers the event, as plain pointer references without copying. When several probes are appended to the same event, they share the trace_event_call and its field list, which stays the one defined by the primary probe. Deleting just the primary probe with "-:group/event symbol" frees the trace_probe and its argument strings, while the event call is kept registered by the remaining sibling probes. field->name and field->type are left dangling, and any field lookup - e.g. writing to events///filter - reads freed memory: BUG: KASAN: slab-use-after-free in strcmp+0xa7/0xb0 Call trace: trace_find_event_field+0xd6/0x220 parse_pred process_preds create_filter apply_event_filter event_filter_write Make the field own its strings: duplicate name and type with kstrdup_const() in __trace_define_field() and release them with kfree_const() in trace_destroy_fields(). Fields of static trace events still reference their kernel/module rodata string literals directly, as kstrdup_const()/kfree_const() only touch memory that was actually allocated. The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab. Fixes: ca89bc071d5e4 ("tracing/kprobe: Add multi-probe per event support") Signed-off-by: Henry Martin --- kernel/trace/trace_events.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index c01b10b99f67e..ee3b93fa09ee8 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -123,8 +123,18 @@ static int __trace_define_field(struct list_head *head= , const char *type, if (!field) return -ENOMEM; =20 - field->name =3D name; - field->type =3D type; + field->name =3D kstrdup_const(name, GFP_TRACE); + if (!field->name) { + kmem_cache_free(field_cachep, field); + return -ENOMEM; + } + + field->type =3D kstrdup_const(type, GFP_TRACE); + if (!field->type) { + kfree_const(field->name); + kmem_cache_free(field_cachep, field); + return -ENOMEM; + } =20 if (filter_type =3D=3D FILTER_OTHER) field->filter_type =3D filter_assign_type(type); @@ -225,6 +235,8 @@ static void trace_destroy_fields(struct trace_event_cal= l *call) head =3D trace_get_fields(call); list_for_each_entry_safe(field, next, head, link) { list_del(&field->link); + kfree_const(field->name); + kfree_const(field->type); kmem_cache_free(field_cachep, field); } } --=20 2.43.0