Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Peter Zijlstra <peterz@infradead.org>]

On Fri, Jul 31, 2026 at 09:56:52AM +0900, Masami Hiramatsu wrote:
> On Thu, 30 Jul 2026 12:38:24 +0200
> Peter Zijlstra <peterz@infradead.org> wrote:
> 
> > On Thu, Jul 30, 2026 at 08:54:21AM +0900, Masami Hiramatsu wrote:
> > > On Wed, 29 Jul 2026 12:31:08 -0700
> > > Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote:
> > > 
> > > > On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
> > > > >
> > > > > On 07/29, Breno Leitao wrote:
> > > > > >
> > > > > > --- a/kernel/events/uprobes.c
> > > > > > +++ b/kernel/events/uprobes.c
> > > > > > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> > > > > >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> > > > > >                       /* We won the race, we are the ones to unlock SRCU */
> > > > > >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > > > > > -                     return get ? get_uprobe(uprobe) : uprobe;
> > > > > > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
> > > > >
> > > > > Well, looks "obviously correct". At least the current code is obviously
> > > > > wrong, it even checks uprobe != NULL 3 lines above.
> > > > >
> > > > > Andrii ?
> > > > >
> > > > 
> > > > Yes, indeed, I'm more surprised this didn't come up much earlier
> > > > (probably it's rare enough to have uretprobe with refcnt at zero
> > > > during fork). The fix looks good, thanks!
> > > > 
> > > > Acked-by: Andrii Nakryiko <andrii@kernel.org>
> > > > 
> > > > > Acked-by: Oleg Nesterov <oleg@redhat.com>
> > > > >
> > > 
> > > Thanks, this seems good to me. (uprobe is NULL checked in try_cmpxchg(),
> > > so it could be NULL.)
> > > 
> > > Can I pick this to probes/fixes branch?
> > 
> > tip/perf/urgent ?
> 
> Either way works. Can we update MAINTAINERS file if you will maintain
> uprobe in tip tree?

Well it is in kernel/events/ which MAINTAINERS should already assign to
me, no?