[PATCH] perf: Fix slab use-after-free in filter_chain

[PATCH] perf: Fix slab use-after-free in filter_chain

[Zafir Rasyidi Taufik]

Syzbot reported a slab use-after-free read in uprobe_mmap. The root cause is
when a trace_probe has a sibling event, unregister_trace_uprobe() does
not unlink &tu->consumer. This memory can still be referenced in
multiple locations, namely filter_chain and uprobe_mmap, resulting in a
use-after-free. This is not a security issue as creating uprobes
requires CAP_SYS_ADMIN.

Here's a short repro in bash which will trigger a KASAN report, tested on
v7.2.4. Note the offsets used for /bin/true may need some adjusting,
they are the offset of its entrypoint in this example:
```
echo "p:uprobe_test/evS /bin/true:0x23d0" >> /sys/kernel/tracing/uprobe_events
echo "p:uprobe_test/evS /bin/true:0x23d4" >> /sys/kernel/tracing/uprobe_events
echo 1 > /sys/kernel/tracing/events/uprobe_test/evS/enable
echo "-:uprobe_test/evS" >> /sys/kernel/tracing/uprobe_events
/bin/true
```

This is my first time sending a patch to the linux kernel mailing list,
apologies if there are any mistakes.

Reported-by: syzbot+1340ad4350ad43394c10@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=1340ad4350ad43394c10
Signed-off-by: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>
Assisted-by: Deepseek v4 Flash
---
 kernel/trace/trace_uprobe.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index c274346853d1..8738c46a6ebf 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -408,6 +408,11 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
 		return ret;
 
 unreg:
+	if (tu->uprobe) {
+		uprobe_unregister_nosync(tu->uprobe, &tu->consumer);
+		tu->uprobe = NULL;
+		uprobe_unregister_sync();
+	}
 	dyn_event_remove(&tu->devent);
 	trace_probe_unlink(&tu->tp);
 	free_trace_uprobe(tu);
-- 
2.43.0

Re: [PATCH] perf: Fix slab use-after-free in filter_chain

[sashiko-bot]

> Syzbot reported a slab use-after-free read in uprobe_mmap. The root cause is
> when a trace_probe has a sibling event, unregister_trace_uprobe() does
> not unlink &tu->consumer. This memory can still be referenced in
> multiple locations, namely filter_chain and uprobe_mmap, resulting in a
> use-after-free. This is not a security issue as creating uprobes
> requires CAP_SYS_ADMIN.
> 
> Here's a short repro in bash which will trigger a KASAN report, tested on
> v7.2.4. Note the offsets used for /bin/true may need some adjusting,
> they are the offset of its entrypoint in this example:
> ```
> echo "p:uprobe_test/evS /bin/true:0x23d0" >> /sys/kernel/tracing/uprobe_events
> echo "p:uprobe_test/evS /bin/true:0x23d4" >> /sys/kernel/tracing/uprobe_events
> echo 1 > /sys/kernel/tracing/events/uprobe_test/evS/enable
> echo "-:uprobe_test/evS" >> /sys/kernel/tracing/uprobe_events
> /bin/true
> ```
> 
> This is my first time sending a patch to the linux kernel mailing list,
> apologies if there are any mistakes.
> 
> Reported-by: syzbot+1340ad4350ad43394c10@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=1340ad4350ad43394c10
> Signed-off-by: Zafir Rasyidi Taufik <zafir.taufik@starlabs.sg>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908023223.1516819-2-zafir.taufik@starlabs.sg?part=1