[PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Breno Leitao]

Forking a task that has a pending uretprobe can oops the kernel with a
NULL pointer dereference in the clone() path:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:hprobe_expire
  CR2: 0000000000000018
  Call Trace:
   uprobe_copy_process
   copy_process
   kernel_clone
   __x64_sys_clone
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

This was found on real hosts on Meta fleet.

I've got the impression that this is what is happening:

  CPU 1                          CPU 2 (traced task)
  -----                          -------------------
                                 hit uprobe, prepare_uretprobe():
                                   hprobe LEASED, refcount >= 1
  uprobe_unregister()
    put_uprobe(): refcount -> 0
                                 fork() -> dup_utask()
                                   hprobe_expire(hprobe, true)
                                     try_get_uprobe() -> NULL
                                     get_uprobe(NULL)   <-- Oops

Only take the extra reference when the uprobe is non-NULL; a NULL means
it is gone and is the correct value to return.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/events/uprobes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 07f69dd3093d5..950108f92079d 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
 		if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
 			/* We won the race, we are the ones to unlock SRCU */
 			__srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
-			return get ? get_uprobe(uprobe) : uprobe;
+			return get && uprobe ? get_uprobe(uprobe) : uprobe;
 		}
 
 		/*

---
base-commit: 3652b49adac266a3d27cb41cdfdb7d8790fc3633
change-id: 20260729-uprobe-b142b0863572

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Oleg Nesterov]

On 07/29, Breno Leitao wrote:
>
> --- a/kernel/events/uprobes.c
> +++ b/kernel/events/uprobes.c
> @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
>  		if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
>  			/* We won the race, we are the ones to unlock SRCU */
>  			__srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> -			return get ? get_uprobe(uprobe) : uprobe;
> +			return get && uprobe ? get_uprobe(uprobe) : uprobe;

Well, looks "obviously correct". At least the current code is obviously
wrong, it even checks uprobe != NULL 3 lines above.

Andrii ?

Acked-by: Oleg Nesterov <oleg@redhat.com>

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Andrii Nakryiko]

On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
>
> On 07/29, Breno Leitao wrote:
> >
> > --- a/kernel/events/uprobes.c
> > +++ b/kernel/events/uprobes.c
> > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> >                       /* We won the race, we are the ones to unlock SRCU */
> >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > -                     return get ? get_uprobe(uprobe) : uprobe;
> > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
>
> Well, looks "obviously correct". At least the current code is obviously
> wrong, it even checks uprobe != NULL 3 lines above.
>
> Andrii ?
>

Yes, indeed, I'm more surprised this didn't come up much earlier
(probably it's rare enough to have uretprobe with refcnt at zero
during fork). The fix looks good, thanks!

Acked-by: Andrii Nakryiko <andrii@kernel.org>

> Acked-by: Oleg Nesterov <oleg@redhat.com>
>
>

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Masami Hiramatsu]

On Wed, 29 Jul 2026 12:31:08 -0700
Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote:

> On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
> >
> > On 07/29, Breno Leitao wrote:
> > >
> > > --- a/kernel/events/uprobes.c
> > > +++ b/kernel/events/uprobes.c
> > > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> > >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> > >                       /* We won the race, we are the ones to unlock SRCU */
> > >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > > -                     return get ? get_uprobe(uprobe) : uprobe;
> > > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
> >
> > Well, looks "obviously correct". At least the current code is obviously
> > wrong, it even checks uprobe != NULL 3 lines above.
> >
> > Andrii ?
> >
> 
> Yes, indeed, I'm more surprised this didn't come up much earlier
> (probably it's rare enough to have uretprobe with refcnt at zero
> during fork). The fix looks good, thanks!
> 
> Acked-by: Andrii Nakryiko <andrii@kernel.org>
> 
> > Acked-by: Oleg Nesterov <oleg@redhat.com>
> >

Thanks, this seems good to me. (uprobe is NULL checked in try_cmpxchg(),
so it could be NULL.)

Can I pick this to probes/fixes branch?

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Peter Zijlstra]

On Thu, Jul 30, 2026 at 08:54:21AM +0900, Masami Hiramatsu wrote:
> On Wed, 29 Jul 2026 12:31:08 -0700
> Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote:
> 
> > On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
> > >
> > > On 07/29, Breno Leitao wrote:
> > > >
> > > > --- a/kernel/events/uprobes.c
> > > > +++ b/kernel/events/uprobes.c
> > > > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> > > >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> > > >                       /* We won the race, we are the ones to unlock SRCU */
> > > >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > > > -                     return get ? get_uprobe(uprobe) : uprobe;
> > > > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
> > >
> > > Well, looks "obviously correct". At least the current code is obviously
> > > wrong, it even checks uprobe != NULL 3 lines above.
> > >
> > > Andrii ?
> > >
> > 
> > Yes, indeed, I'm more surprised this didn't come up much earlier
> > (probably it's rare enough to have uretprobe with refcnt at zero
> > during fork). The fix looks good, thanks!
> > 
> > Acked-by: Andrii Nakryiko <andrii@kernel.org>
> > 
> > > Acked-by: Oleg Nesterov <oleg@redhat.com>
> > >
> 
> Thanks, this seems good to me. (uprobe is NULL checked in try_cmpxchg(),
> so it could be NULL.)
> 
> Can I pick this to probes/fixes branch?

tip/perf/urgent ?

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Masami Hiramatsu]

On Thu, 30 Jul 2026 12:38:24 +0200
Peter Zijlstra <peterz@infradead.org> wrote:

> On Thu, Jul 30, 2026 at 08:54:21AM +0900, Masami Hiramatsu wrote:
> > On Wed, 29 Jul 2026 12:31:08 -0700
> > Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote:
> > 
> > > On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
> > > >
> > > > On 07/29, Breno Leitao wrote:
> > > > >
> > > > > --- a/kernel/events/uprobes.c
> > > > > +++ b/kernel/events/uprobes.c
> > > > > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> > > > >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> > > > >                       /* We won the race, we are the ones to unlock SRCU */
> > > > >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > > > > -                     return get ? get_uprobe(uprobe) : uprobe;
> > > > > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
> > > >
> > > > Well, looks "obviously correct". At least the current code is obviously
> > > > wrong, it even checks uprobe != NULL 3 lines above.
> > > >
> > > > Andrii ?
> > > >
> > > 
> > > Yes, indeed, I'm more surprised this didn't come up much earlier
> > > (probably it's rare enough to have uretprobe with refcnt at zero
> > > during fork). The fix looks good, thanks!
> > > 
> > > Acked-by: Andrii Nakryiko <andrii@kernel.org>
> > > 
> > > > Acked-by: Oleg Nesterov <oleg@redhat.com>
> > > >
> > 
> > Thanks, this seems good to me. (uprobe is NULL checked in try_cmpxchg(),
> > so it could be NULL.)
> > 
> > Can I pick this to probes/fixes branch?
> 
> tip/perf/urgent ?

Either way works. Can we update MAINTAINERS file if you will maintain
uprobe in tip tree?

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Peter Zijlstra]

On Fri, Jul 31, 2026 at 09:56:52AM +0900, Masami Hiramatsu wrote:
> On Thu, 30 Jul 2026 12:38:24 +0200
> Peter Zijlstra <peterz@infradead.org> wrote:
> 
> > On Thu, Jul 30, 2026 at 08:54:21AM +0900, Masami Hiramatsu wrote:
> > > On Wed, 29 Jul 2026 12:31:08 -0700
> > > Andrii Nakryiko <andrii.nakryiko@gmail.com> wrote:
> > > 
> > > > On Wed, Jul 29, 2026 at 9:02 AM Oleg Nesterov <oleg@redhat.com> wrote:
> > > > >
> > > > > On 07/29, Breno Leitao wrote:
> > > > > >
> > > > > > --- a/kernel/events/uprobes.c
> > > > > > +++ b/kernel/events/uprobes.c
> > > > > > @@ -832,7 +832,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
> > > > > >               if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
> > > > > >                       /* We won the race, we are the ones to unlock SRCU */
> > > > > >                       __srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
> > > > > > -                     return get ? get_uprobe(uprobe) : uprobe;
> > > > > > +                     return get && uprobe ? get_uprobe(uprobe) : uprobe;
> > > > >
> > > > > Well, looks "obviously correct". At least the current code is obviously
> > > > > wrong, it even checks uprobe != NULL 3 lines above.
> > > > >
> > > > > Andrii ?
> > > > >
> > > > 
> > > > Yes, indeed, I'm more surprised this didn't come up much earlier
> > > > (probably it's rare enough to have uretprobe with refcnt at zero
> > > > during fork). The fix looks good, thanks!
> > > > 
> > > > Acked-by: Andrii Nakryiko <andrii@kernel.org>
> > > > 
> > > > > Acked-by: Oleg Nesterov <oleg@redhat.com>
> > > > >
> > > 
> > > Thanks, this seems good to me. (uprobe is NULL checked in try_cmpxchg(),
> > > so it could be NULL.)
> > > 
> > > Can I pick this to probes/fixes branch?
> > 
> > tip/perf/urgent ?
> 
> Either way works. Can we update MAINTAINERS file if you will maintain
> uprobe in tip tree?

Well it is in kernel/events/ which MAINTAINERS should already assign to
me, no?

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Oleg Nesterov]

On 07/31, Peter Zijlstra wrote:
>
> On Fri, Jul 31, 2026 at 09:56:52AM +0900, Masami Hiramatsu wrote:
> > On Thu, 30 Jul 2026 12:38:24 +0200
> >
> > Either way works. Can we update MAINTAINERS file if you will maintain
> > uprobe in tip tree?
>
> Well it is in kernel/events/ which MAINTAINERS should already assign to
> me, no?

Confused... you are already listed as a maintainer. From MAINTAINERS:

	UPROBES
	M:	Masami Hiramatsu <mhiramat@kernel.org>
	M:	Oleg Nesterov <oleg@redhat.com>
	M:	Peter Zijlstra <peterz@infradead.org>
	L:	linux-kernel@vger.kernel.org
	L:	linux-trace-kernel@vger.kernel.org
	S:	Maintained
	F:	arch/*/include/asm/uprobes.h
	F:	arch/*/kernel/probes/uprobes.c
	F:	arch/*/kernel/uprobes.c
	F:	include/linux/uprobes.h
	F:	kernel/events/uprobes.c

Oleg.

Re: [PATCH] uprobes: Fix NULL pointer dereference in hprobe_expire()

[Peter Zijlstra]

On Fri, Jul 31, 2026 at 10:43:03AM +0200, Oleg Nesterov wrote:
> On 07/31, Peter Zijlstra wrote:
> >
> > On Fri, Jul 31, 2026 at 09:56:52AM +0900, Masami Hiramatsu wrote:
> > > On Thu, 30 Jul 2026 12:38:24 +0200
> > >
> > > Either way works. Can we update MAINTAINERS file if you will maintain
> > > uprobe in tip tree?
> >
> > Well it is in kernel/events/ which MAINTAINERS should already assign to
> > me, no?
> 
> Confused... you are already listed as a maintainer. From MAINTAINERS:
> 
> 	UPROBES
> 	M:	Masami Hiramatsu <mhiramat@kernel.org>
> 	M:	Oleg Nesterov <oleg@redhat.com>
> 	M:	Peter Zijlstra <peterz@infradead.org>
> 	L:	linux-kernel@vger.kernel.org
> 	L:	linux-trace-kernel@vger.kernel.org
> 	S:	Maintained
> 	F:	arch/*/include/asm/uprobes.h
> 	F:	arch/*/kernel/probes/uprobes.c
> 	F:	arch/*/kernel/uprobes.c
> 	F:	include/linux/uprobes.h
> 	F:	kernel/events/uprobes.c

Yes, but the 'PERFORMANCE EVENTS SUBSYSTEM' entry will also cover this.
So I have it twice ;-)

PERFORMANCE EVENTS SUBSYSTEM
...
F:      kernel/events/*

Anyway, patch should be in tip/perf/urgent now.

[tip: perf/urgent] uprobes: Fix NULL pointer dereference in hprobe_expire()

[tip-bot2 for Breno Leitao]

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     cc679d7a6303e84d769f2afcde1fc51c51f127cd
Gitweb:        https://git.kernel.org/tip/cc679d7a6303e84d769f2afcde1fc51c51f127cd
Author:        Breno Leitao <leitao@debian.org>
AuthorDate:    Wed, 29 Jul 2026 07:44:40 -07:00
Committer:     Peter Zijlstra <peterz@infradead.org>
CommitterDate: Fri, 31 Jul 2026 10:32:19 +02:00

uprobes: Fix NULL pointer dereference in hprobe_expire()

Forking a task that has a pending uretprobe can oops the kernel with a
NULL pointer dereference in the clone() path:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  Oops: 0002 [#1] SMP NOPTI
  RIP: 0010:hprobe_expire
  CR2: 0000000000000018
  Call Trace:
   uprobe_copy_process
   copy_process
   kernel_clone
   __x64_sys_clone
   do_syscall_64
   entry_SYSCALL_64_after_hwframe

This was found on real hosts on Meta fleet.

I've got the impression that this is what is happening:

  CPU 1                          CPU 2 (traced task)
  -----                          -------------------
                                 hit uprobe, prepare_uretprobe():
                                   hprobe LEASED, refcount >= 1
  uprobe_unregister()
    put_uprobe(): refcount -> 0
                                 fork() -> dup_utask()
                                   hprobe_expire(hprobe, true)
                                     try_get_uprobe() -> NULL
                                     get_uprobe(NULL)   <-- Oops

Only take the extra reference when the uprobe is non-NULL; a NULL means
it is gone and is the correct value to return.

Fixes: dd1a7567784e ("uprobes: SRCU-protect uretprobe lifetime (with timeout)")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260729-uprobe-v1-1-61896b87c867@debian.org
---
 kernel/events/uprobes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 4084e92..6300b21 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -830,7 +830,7 @@ static struct uprobe *hprobe_expire(struct hprobe *hprobe, bool get)
 		if (try_cmpxchg(&hprobe->state, &hstate, uprobe ? HPROBE_STABLE : HPROBE_GONE)) {
 			/* We won the race, we are the ones to unlock SRCU */
 			__srcu_read_unlock(&uretprobes_srcu, hprobe->srcu_idx);
-			return get ? get_uprobe(uprobe) : uprobe;
+			return get && uprobe ? get_uprobe(uprobe) : uprobe;
 		}
 
 		/*