Re: ftrace: UAF in ftrace_regex_open() on a removed tracing instance

[Steven Rostedt <rostedt@goodmis.org>]

On Fri, 28 Aug 2026 08:59:39 -0700
Breno Leitao <leitao@debian.org> wrote:

>  ftrace_filter_open(struct inode *inode, struct file *file)
>  {
> -	struct ftrace_ops *ops = inode->i_private;
> +	struct trace_array *tr = inode->i_private;
> +	int ret;
>  
> -	/* Checks for tracefs lockdown */
> -	return ftrace_regex_open(ops,
> -			FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
> -			inode, file);
> +	/* Checks for tracefs lockdown, and that the instance is still alive */
> +	ret = tracing_check_open_get_tr(tr);
> +	if (ret)
> +		return ret;
> +
> +	ret = ftrace_regex_open(tr->ops,
> +				FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
> +				inode, file);
> +	/* ftrace_regex_open() holds its own reference on success */

Hmm, I just noticed this part (from reviewing my own code first, and then
looking at what your AI did).

I guess the issue is that the ops may be freed before you get access to the
trace array. Anyway more needs to be changed. I may remove the extra
reference. No need to do it twice. Also since trace_stack may have the
issue too.

-- Steve


> +	trace_array_put(tr);
> +	return ret;
>  }