[PATCH] tracing: uprobes: Fix slab use-after-free in filter_chain

[PATCH] tracing: uprobes: Fix slab use-after-free in filter_chain

[zafir.taufik]

From: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>

Syzbot reported a slab use-after-free read in uprobe_mmap. The root cause is
when a trace_probe has a sibling event, unregister_trace_uprobe() does
not unlink &tu->consumer. This memory can still be referenced in
multiple locations, namely filter_chain and uprobe_mmap, resulting in a
use-after-free. This is not a security issue as creating uprobes
requires CAP_SYS_ADMIN.

Here's a short repro in bash which will trigger a KASAN report, tested on
v7.2.4. Note the offsets used for /bin/true may need some adjusting,
they are the offset of its entrypoint in this example:
```
echo "p:uprobe_test/evS /bin/true:0x23d0" >> /sys/kernel/tracing/uprobe_events
echo "p:uprobe_test/evS /bin/true:0x23d4" >> /sys/kernel/tracing/uprobe_events
echo 1 > /sys/kernel/tracing/events/uprobe_test/evS/enable
echo "-:uprobe_test/evS" >> /sys/kernel/tracing/uprobe_events
/bin/true
```

I originally reported this to the perf maintainers (because of tag by
syzbot) but I should've reported it here instead.

Reported-by: syzbot+1340ad4350ad43394c10@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1340ad4350ad43394c10
Signed-off-by: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>
Assisted-by: Deepseek v4 Flash
---
 kernel/trace/trace_uprobe.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index c274346853d1..8738c46a6ebf 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
 		return ret;
 
 unreg:
+	if (tu->uprobe) {
+		uprobe_unregister_nosync(tu->uprobe, &tu->consumer);
+		tu->uprobe = NULL;
+		uprobe_unregister_sync();
+	}
 	dyn_event_remove(&tu->devent);
 	trace_probe_unlink(&tu->tp);
 	free_trace_uprobe(tu);
-- 
2.43.0

Re: [PATCH] tracing: uprobes: Fix slab use-after-free in filter_chain

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Race condition in unregister_trace_uprobe leads to use-after-free (UAF) of trace_uprobe during lockless read accesses.
--

commit 04fcafa318e6d04f74e677950139db1dd3bf079c
Author: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>

tracing: uprobes: Fix slab use-after-free in filter_chain

This commit addresses a use-after-free in uprobe_mmap. It resolves an issue
where unregister_trace_uprobe() would fail to unlink the consumer when a
trace_probe has a sibling event.

> diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
> index 861d857adadb3..110ec7b78b3dc 100644
> --- a/kernel/trace/trace_uprobe.c
> +++ b/kernel/trace/trace_uprobe.c
> @@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
>  		return ret;
>  
>  unreg:
> +	if (tu->uprobe) {
> +		uprobe_unregister_nosync(tu->uprobe, &tu->consumer);
> +		tu->uprobe = NULL;
> +		uprobe_unregister_sync();
> +	}
>  	dyn_event_remove(&tu->devent);
>  	trace_probe_unlink(&tu->tp);
>  	free_trace_uprobe(tu);

[Severity: Critical]
This is a pre-existing issue, but does this code leave a window for a
use-after-free of trace_uprobe during lockless read accesses?

When a sibling probe exists, this code unlinks and immediately frees the
trace probe without synchronizing with trace readers via RCU or shared locks.

For example, when a user queries an attached perf event, it initiates a
lockless traversal:

bpf_task_fd_query()
  bpf_get_perf_event_info()
    bpf_get_uprobe_info()
      trace_uprobe_primary_from_call()

This accesses the trace probe structure without acquiring event_mutex or
trace_event_sem.

Additionally, even if trace_event_sem is held for read, such as during
print_uprobe_event(), unregister_trace_uprobe() bypasses taking
trace_event_sem for write when unregistering a sibling probe (it skips
unregister_uprobe_event() and jumps directly to unreg).

At the same time, if unregister_trace_uprobe() is called, it unlinks the
probe via trace_probe_unlink(). The list removal relies on standard
list_del_init() instead of list_del_rcu(), allowing concurrent lockless
readers to traverse into soon-to-be-freed nodes when free_trace_uprobe(tu)
is called immediately after.

Could this lead to memory corruption when readers access the freed probe?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910023106.1795811-3-zafir.taufik@starlabs.sg?part=1

Re: [PATCH] tracing: uprobes: Fix slab use-after-free in filter_chain

[Zafir Rasyidi Taufik]

On Thu, Sep 10, 2026 at 02:48:49AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Critical] Race condition in unregister_trace_uprobe leads to use-after-free (UAF) of trace_uprobe during lockless read accesses.
> --
> 
> commit 04fcafa318e6d04f74e677950139db1dd3bf079c
> Author: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>
> 
> tracing: uprobes: Fix slab use-after-free in filter_chain
> 
> This commit addresses a use-after-free in uprobe_mmap. It resolves an issue
> where unregister_trace_uprobe() would fail to unlink the consumer when a
> trace_probe has a sibling event.
> 
> > diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
> > index 861d857adadb3..110ec7b78b3dc 100644
> > --- a/kernel/trace/trace_uprobe.c
> > +++ b/kernel/trace/trace_uprobe.c
> > @@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
> >  		return ret;
> >  
> >  unreg:
> > +	if (tu->uprobe) {
> > +		uprobe_unregister_nosync(tu->uprobe, &tu->consumer);
> > +		tu->uprobe = NULL;
> > +		uprobe_unregister_sync();
> > +	}
> >  	dyn_event_remove(&tu->devent);
> >  	trace_probe_unlink(&tu->tp);
> >  	free_trace_uprobe(tu);
> 
> [Severity: Critical]
> This is a pre-existing issue, but does this code leave a window for a
> use-after-free of trace_uprobe during lockless read accesses?
> 
> When a sibling probe exists, this code unlinks and immediately frees the
> trace probe without synchronizing with trace readers via RCU or shared locks.
> 
> For example, when a user queries an attached perf event, it initiates a
> lockless traversal:
> 
> bpf_task_fd_query()
>   bpf_get_perf_event_info()
>     bpf_get_uprobe_info()
>       trace_uprobe_primary_from_call()
> 
> This accesses the trace probe structure without acquiring event_mutex or
> trace_event_sem.
> 
> Additionally, even if trace_event_sem is held for read, such as during
> print_uprobe_event(), unregister_trace_uprobe() bypasses taking
> trace_event_sem for write when unregistering a sibling probe (it skips
> unregister_uprobe_event() and jumps directly to unreg).
> 
> At the same time, if unregister_trace_uprobe() is called, it unlinks the
> probe via trace_probe_unlink(). The list removal relies on standard
> list_del_init() instead of list_del_rcu(), allowing concurrent lockless
> readers to traverse into soon-to-be-freed nodes when free_trace_uprobe(tu)
> is called immediately after.
> 
> Could this lead to memory corruption when readers access the freed probe?

I will investigate furthur regarding this. If it's correct I will think
of a patch and send it separately.

> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260910023106.1795811-3-zafir.taufik@starlabs.sg?part=1