Re: [PATCH v2 1/2] tracing/user_events: validate dynamic cpumask size

[Beau Belgrave <beaub@linux.microsoft.com>]

On Tue, Nov 03, 2026 at 10:45:19AM +0800, Yifan Zhang wrote:
> user_event_validate() checks that a dynamic field lies inside the event but
> does not verify the minimum size required by its filter type.  A one-byte
> dynamic cpumask can therefore reach filter_pred_cpumask(), which consumes
> cpumask_size() bytes beyond the event buffer.
> 
> KASAN reports:
> 
>   BUG: KASAN: slab-use-after-free in filter_match_preds
>   Read of size 8
>   filter_match_preds

Hey Yifan,

In the V1 there was a repro case where this value was a __data_loc,
which defines where the actual data (and it's size) is in the payload.

There isn't a type min-size requirement when __data_loc is used, this
seems like the bug resides possibly in filter_match_preds for
__data_loc cases? See comments futher down.

Steve, do you think this is the case?

If not, then I guess we would have to validate min-size requirements of
all types in the dynamic case, and I hope we could do that centrally to
avoid fixing these in various spots.

>   trace_event_buffer_commit
>   user_event_ftrace
>   user_events_write_core
> 
> Mark dynamic cpumask fields and reject locations shorter than
> cpumask_size().
> 
> The patched kernel rejects the short event and accepts a full-size control
> event without a KASAN report.
> 
> Fixes: 2467cda1b5c9 ("user_events: Validate user payloads for size and null termination")
> Signed-off-by: Yifan Zhang <yfzhang23@stu.pku.edu.cn>
> ---
>  kernel/trace/trace_events_user.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/kernel/trace/trace_events_user.c b/kernel/trace/trace_events_user.c
> index f658c3a77aa7a..85938b45b7618 100644
> --- a/kernel/trace/trace_events_user.c
> +++ b/kernel/trace/trace_events_user.c
> @@ -170,6 +170,7 @@ struct user_event_file_info {
>  
>  #define VALIDATOR_ENSURE_NULL (1 << 0)
>  #define VALIDATOR_REL (1 << 1)
> +#define VALIDATOR_CPUMASK BIT(2)
>  
>  struct user_event_validator {
>  	struct list_head	user_event_link;
> @@ -1159,6 +1160,9 @@ static int user_event_add_field(struct user_event *user, const char *type,
>  	if (strstr(type, "char") != NULL)
>  		validator_flags |= VALIDATOR_ENSURE_NULL;
>  
> +	if (strstr(type, "cpumask_t"))
> +		validator_flags |= VALIDATOR_CPUMASK;
> +

You can only get to this case if you put struct, __rel_loc, or __data_loc.
Those have their own size requirements and are dynamic in nature, IE:
Each write describes the actual size in the __rel_loc and __data_loc
cases, and statically for the struct case.

user_field_size() checks if a type name has a known size, if not, it
gets rejected. The only time this isn't the case is if you put struct in
front and then have to give a size that's expected. The other case is if
you put __data_loc or __rel_loc, both require the payload to dynamically
have a size associated.

In the dynamic case, the filter should be ensuring these values are
minimally sized.

>  	validator = kmalloc_obj(*validator, GFP_KERNEL_ACCOUNT);
>  
>  	if (!validator) {
> @@ -1598,6 +1602,10 @@ static int user_event_validate(struct user_event *user, void *data, int len)
>  		offset = loc & 0xffff;
>  		size = loc >> 16;
>  
> +		if (unlikely((validator->flags & VALIDATOR_CPUMASK) &&
> +			     size < cpumask_size()))
> +			return -EFAULT;
> +
>  		if (likely(validator->flags & VALIDATOR_REL))
>  			pos += offset + sizeof(loc);
>  		else
> -- 
> 2.39.5 (Apple Git-154)

Thanks,
-Beau