Re: [PATCH] tracing: uprobes: Fix slab use-after-free in filter_chain
From: sashiko-bot@kernel.org
Date: 2026-09-10 02:48:50
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [Critical] Race condition in unregister_trace_uprobe leads to use-after-free (UAF) of trace_uprobe during lockless read accesses. -- commit 04fcafa318e6d04f74e677950139db1dd3bf079c Author: Zafir Rasyidi Taufik [off-list ref] tracing: uprobes: Fix slab use-after-free in filter_chain This commit addresses a use-after-free in uprobe_mmap. It resolves an issue where unregister_trace_uprobe() would fail to unlink the consumer when a trace_probe has a sibling event.
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index 861d857adadb3..110ec7b78b3dc 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c@@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu) return ret; unreg: + if (tu->uprobe) { + uprobe_unregister_nosync(tu->uprobe, &tu->consumer); + tu->uprobe = NULL; + uprobe_unregister_sync(); + } dyn_event_remove(&tu->devent); trace_probe_unlink(&tu->tp); free_trace_uprobe(tu);
[Severity: Critical]
This is a pre-existing issue, but does this code leave a window for a
use-after-free of trace_uprobe during lockless read accesses?
When a sibling probe exists, this code unlinks and immediately frees the
trace probe without synchronizing with trace readers via RCU or shared locks.
For example, when a user queries an attached perf event, it initiates a
lockless traversal:
bpf_task_fd_query()
bpf_get_perf_event_info()
bpf_get_uprobe_info()
trace_uprobe_primary_from_call()
This accesses the trace probe structure without acquiring event_mutex or
trace_event_sem.
Additionally, even if trace_event_sem is held for read, such as during
print_uprobe_event(), unregister_trace_uprobe() bypasses taking
trace_event_sem for write when unregistering a sibling probe (it skips
unregister_uprobe_event() and jumps directly to unreg).
At the same time, if unregister_trace_uprobe() is called, it unlinks the
probe via trace_probe_unlink(). The list removal relies on standard
list_del_init() instead of list_del_rcu(), allowing concurrent lockless
readers to traverse into soon-to-be-freed nodes when free_trace_uprobe(tu)
is called immediately after.
Could this lead to memory corruption when readers access the freed probe?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260910023106.1795811-3-zafir.taufik@starlabs.sg?part=1