mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 02:17:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

tracing/user_events: Fix use-after-free in user_event_mm_dup()

Browse Source 
user_event_mm_dup() walks the parent mm's enabler list locklessly under
rcu_read_lock() during fork() (from copy_process()); it does not take
event_mutex:

	rcu_read_lock();
	list_for_each_entry_rcu(enabler, &old_mm->enablers, mm_enablers_link)
		enabler->event = user_event_get(orig->event);

user_event_enabler_destroy() removes an enabler from that list with
list_del_rcu() and then, without waiting for a grace period, drops the
enabler's user_event reference with user_event_put() and frees the enabler
with kfree(). A reader that loaded the enabler before the list_del_rcu()
can still be walking it, which leads to two use-after-frees:

 - kfree(enabler) frees the enabler while that reader dereferences
   enabler->event.

 - user_event_put() may drop the last reference to the user_event, which
   is then freed (via delayed_destroy_user_event() on a work queue), while
   the same reader does user_event_get(orig->event) on it.

Both are reachable by an unprivileged task that can open user_events_data:
one multithreaded process that registers an enabler and then concurrently
unregisters it and calls fork() triggers the race. KASAN reports a
slab-use-after-free in user_event_mm_dup() during clone(), with a
"refcount_t: addition on 0" warning when the user_event is freed.

The enabler use-after-free was found first; the user_event one was reported
by XIAO WU, and the earlier enabler-only fix did not address it.

Defer both the user_event_put() and the kfree(enabler) to a work item
queued with queue_rcu_work(), so they run only after an RCU grace period,
once all readers walking the enabler list have finished. The put must run
in process context because user_event_put() takes event_mutex on the last
reference, so a work queue is used rather than call_rcu(). The now-unlocked
put lets the locked argument of user_event_enabler_destroy() be removed;
all callers are updated.

Fixes: 7235759084 ("tracing/user_events: Use remote writes for event enablement")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260707165912.2560537-2-michael.bommarito@gmail.com
Reported-by: XIAO WU <xiaowu.417@qq.com>
Closes: https://lore.kernel.org/all/tencent_89647CE40DC452B891C65C94D1B271DE8E07@qq.com/
Suggested-by: Beau Belgrave <beaub@linux.microsoft.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
Michael Bommarito
2026-07-07 12:59:11 -04:00
committed by Steven Rostedt
parent 1e67bb60bb
commit 50fd6dd755
1 changed files with 34 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
kernel/trace/trace_events_user.c
View File

@@ -109,6 +109,9 @@ struct user_event_enabler {
/* Track enable bit, flags, etc. Aligned for bitops. */
unsigned long values;
/* Defer the event put and enabler free past an RCU grace period. */
struct rcu_work put_rwork;
};
/* Bits 0-5 are for the bit to update upon enable/disable (0-63 allowed) */
@@ -396,15 +399,37 @@ static struct user_event_group *user_event_group_create(void)
return NULL;
};
static void user_event_enabler_destroy(struct user_event_enabler *enabler,
bool locked)
static void delayed_user_event_enabler_put(struct work_struct *work)
{
struct user_event_enabler *enabler = container_of(to_rcu_work(work),
struct user_event_enabler, put_rwork);
/* No longer tracking the event via the enabler */
user_event_put(enabler->event, false);
/* Run from queue_rcu_work(), the RCU grace period has elapsed */
kfree(enabler);
}
static void user_event_enabler_destroy(struct user_event_enabler *enabler)
{
list_del_rcu(&enabler->mm_enablers_link);
/* No longer tracking the event via the enabler */
user_event_put(enabler->event, locked);
kfree(enabler);
/*
* The enabler is removed from an RCU-traversed list
* (user_event_mm_dup() walks mm->enablers under rcu_read_lock() only),
* and readers there dereference enabler->event and take a new ref on
* it. Both the put of that event reference and the free of the enabler
* therefore have to wait for a grace period so no reader can be looking
* at the enabler or racing the last put of its event.
*
* The put itself must not run in RCU context: when it drops the last
* reference user_event_put() takes event_mutex, which cannot be taken
* from a softirq/RCU callback. Defer both to a work item scheduled
* after a grace period via queue_rcu_work().
*/
INIT_RCU_WORK(&enabler->put_rwork, delayed_user_event_enabler_put);
queue_rcu_work(system_percpu_wq, &enabler->put_rwork);
}
static int user_event_mm_fault_in(struct user_event_mm *mm, unsigned long uaddr,
@@ -464,7 +489,7 @@ static void user_event_enabler_fault_fixup(struct work_struct *work)
/* User asked for enabler to be removed during fault */
if (test_bit(ENABLE_VAL_FREEING_BIT, ENABLE_BITOPS(enabler))) {
user_event_enabler_destroy(enabler, true);
user_event_enabler_destroy(enabler);
goto out;
}
@@ -764,7 +789,7 @@ static void user_event_mm_destroy(struct user_event_mm *mm)
struct user_event_enabler *enabler, *next;
list_for_each_entry_safe(enabler, next, &mm->enablers, mm_enablers_link)
user_event_enabler_destroy(enabler, false);
user_event_enabler_destroy(enabler);
mmdrop(mm->mm);
kfree(mm);
@@ -2645,7 +2670,7 @@ static long user_events_ioctl_unreg(unsigned long uarg)
flags |= enabler->values & ENABLE_VAL_COMPAT_MASK;
if (!test_bit(ENABLE_VAL_FAULTING_BIT, ENABLE_BITOPS(enabler)))
user_event_enabler_destroy(enabler, true);
user_event_enabler_destroy(enabler);
/* Removed at least one */
ret = 0;