Hello Masami and the linux-trace-kernel team, I am reporting a tracing/uprobe error-path crash found by syzkaller with fault injection.
Summary:
A write(2) to /sys/kernel/tracing/uprobe_events that fails inside
alloc_trace_uprobe() leaves the caller's `tu` variable holding
ERR_PTR(-ENOMEM). The cleanup macro at kernel/trace/trace_uprobe.c:536:
DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *,
if (_T) free_trace_uprobe(_T))
guards only against NULL, not IS_ERR. free_trace_uprobe() (invoked by
the __free() helper at __trace_uprobe_create's return) has the same
guard shape -- `if (!tu) return;` -- and then calls path_put(&tu->path)
on the ERR_PTR-valued tu. KASAN catches the resulting dereference as a
null-ptr-deref-in-range at path_put+0x29.
Observed on:
- Linux v7.1-rc3-200-g70eda68668d1-dirty (where the bug was originally
found), x86_64, QEMU Q35
- KASAN enabled; panic_on_warn set; CONFIG_FAULT_INJECTION enabled
- The only local dirty file in my tree is drivers/tty/serial/serial_core.c,
containing a local ttyS0 console guard for the fuzzing harness. It is
unrelated to kernel/trace/.
- Trigger requires CAP_SYS_ADMIN to open /sys/kernel/tracing/uprobe_events
for write (mode 0640, TRACE_MODE_WRITE) plus CONFIG_FAULT_INJECTION
with a forced kmalloc failure inside alloc_trace_uprobe().
- Source inspection of linus/master at commit e8c2f9fdadee
(v7.1-rc4-754-ge8c2f9fdadee) shows the buggy structure is unchanged:
DEFINE_FREE(free_trace_uprobe, ..., if (_T) free_trace_uprobe(_T)) at
trace_uprobe.c:536 has only a NULL guard, free_trace_uprobe() at
trace_uprobe.c:369 still has only `if (!tu) return;`, and
__trace_uprobe_create() declares `struct trace_uprobe *tu
__free(free_trace_uprobe) = NULL` and assigns the alloc_trace_uprobe()
return value into tu before any IS_ERR check.
Impact:
With CONFIG_FAULT_INJECTION enabled, a fail_nth-injected allocation
failure inside alloc_trace_uprobe() (kzalloc_flex at line 341 returns
NULL, the function returns ERR_PTR(-ENOMEM)) causes the
__free(free_trace_uprobe) cleanup in __trace_uprobe_create() to
dereference the ERR_PTR via path_put():
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000008: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
RIP: 0010:path_put+0x29/0x60 fs/namei.c:717
The R12 register in the crash dump shows the smoking gun:
R12 = 0xfffffffffffffff4 = -ENOMEM = ERR_PTR(-12) -- i.e. the `tu`
pointer being freed is an ERR_PTR, not a real object.
Relevant stack:
path_put+0x29/0x60 fs/namei.c:717
free_trace_uprobe kernel/trace/trace_uprobe.c:374 [inline]
__free_free_trace_uprobe kernel/trace/trace_uprobe.c:536 [inline]
__trace_uprobe_create+0x53c/0xe40 kernel/trace/trace_uprobe.c:725
trace_probe_create+0xce/0x130 kernel/trace/trace_probe.c:2252
dyn_event_create+0x4f/0x70 kernel/trace/trace_dynevent.c:128
create_or_delete_trace_uprobe+0x65/0xa0 kernel/trace/trace_uprobe.c:739
trace_parse_run_command+0x1f3/0x380 kernel/trace/trace.c:9565
vfs_write+0x29f/0xb90 fs/read_write.c:686
ksys_write+0x155/0x270 fs/read_write.c:740
Expected behavior:
Any one of these closes the hole:
1. Tighten free_trace_uprobe()'s entry guard:
if (IS_ERR_OR_NULL(tu))
return;
2. Or change the DEFINE_FREE macro to skip ERR_PTR values:
DEFINE_FREE(free_trace_uprobe, struct trace_uprobe *,
if (!IS_ERR_OR_NULL(_T)) free_trace_uprobe(_T))
3. Or, after the IS_ERR(tu) check in __trace_uprobe_create(), assign
`tu = NULL;` before returning so the __free helper sees NULL and
skips the path_put.
Reproducer:
I attached the generated C reproducer as reproducer.c. I also attached the
syzkaller program as reproducer.syz and the console
report as crash-report.txt.
Novelty check:
I searched syzbot dashboard data across upstream, fixed, invalid, stable,
and Android namespaces, and searched lore.kernel.org for "path_put" +
"trace_uprobe", "free_trace_uprobe", and "__trace_uprobe_create" + "GPF" /
"KASAN". I did not find an exact match. Adjacent uprobe_unregister /
bpf_uprobe_multi_link UAF reports have different free paths.
I appreciate your time and consideration, and I'm grateful for your
work on this subsystem.
Regards,
Farhad
RBP: 00007ffccc56d910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f528c605fa0 R14: 00007f528c605fa0 R15: 0000000000001e91 </TASK> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] CPU: 0 UID: 0 PID: 3563 Comm: syz.2.17 Not tainted 7.1.0-rc3-00200-g70eda68668d1-dirty #1 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:path_put+0x29/0x60 fs/namei.c:717 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df e8 22 91 8a ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 db 50 f4 ff 48 8b 7b 08 e8 c2 89 03 00 48 RSP: 0018:ffffc900035bf9e8 EFLAGS: 00010203 RAX: 0000000000000008 RBX: 000000000000003c RCX: ffff88810c36a500 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000044 RBP: ffffc900035bfb70 R08: ffffffff9165b777 R09: 0000000000000000 R10: ffffffff9165b760 R11: fffffbfff22cb6ef R12: fffffffffffffff4 R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000555560a86500(0000) GS:ffff8882ab6b6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f528c240760 CR3: 00000001214cb000 CR4: 0000000000750ef0 PKRU: 00000000 Call Trace: <TASK> free_trace_uprobe kernel/trace/trace_uprobe.c:374 [inline] __free_free_trace_uprobe kernel/trace/trace_uprobe.c:536 [inline] __trace_uprobe_create+0x53c/0xe40 kernel/trace/trace_uprobe.c:725 trace_probe_create+0xce/0x130 kernel/trace/trace_probe.c:2252 dyn_event_create+0x4f/0x70 kernel/trace/trace_dynevent.c:128 create_or_delete_trace_uprobe+0x65/0xa0 kernel/trace/trace_uprobe.c:739 trace_parse_run_command+0x1f3/0x380 kernel/trace/trace.c:9565 vfs_write+0x29f/0xb90 fs/read_write.c:686 ksys_write+0x155/0x270 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0x560 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f528c37778d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffccc56d8a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f528c605fa0 RCX: 00007f528c37778d RDX: 0000000000000022 RSI: 0000200000001100 RDI: 0000000000000003 RBP: 00007ffccc56d910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f528c605fa0 R14: 00007f528c605fa0 R15: 0000000000001e91 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:path_put+0x29/0x60 fs/namei.c:717 Code: 90 f3 0f 1e fa 0f 1f 44 00 00 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df e8 22 91 8a ff 48 8d 7b 08 48 89 f8 48 c1 e8 03 <42> 80 3c 30 00 74 05 e8 db 50 f4 ff 48 8b 7b 08 e8 c2 89 03 00 48 RSP: 0018:ffffc900035bf9e8 EFLAGS: 00010203 RAX: 0000000000000008 RBX: 000000000000003c RCX: ffff88810c36a500 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000044 RBP: ffffc900035bfb70 R08: ffffffff9165b777 R09: 0000000000000000 R10: ffffffff9165b760 R11: fffffbfff22cb6ef R12: fffffffffffffff4 R13: dffffc0000000000 R14: dffffc0000000000 R15: 0000000000000000 FS: 0000555560a86500(0000) GS:ffff8882ab6b6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f528c240760 CR3: 00000001214cb000 CR4: 0000000000750ef0 PKRU: 00000000 ---------------- Code disassembly (best guess): 0: 90 nop 1: f3 0f 1e fa endbr64 5: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) a: 41 56 push %r14 c: 53 push %rbx d: 48 89 fb mov %rdi,%rbx 10: 49 be 00 00 00 00 00 movabs $0xdffffc0000000000,%r14 17: fc ff df 1a: e8 22 91 8a ff call 0xff8a9141 1f: 48 8d 7b 08 lea 0x8(%rbx),%rdi 23: 48 89 f8 mov %rdi,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 30 00 cmpb $0x0,(%rax,%r14,1) <-- trapping instruction 2f: 74 05 je 0x36 31: e8 db 50 f4 ff call 0xfff45111 36: 48 8b 7b 08 mov 0x8(%rbx),%rdi 3a: e8 c2 89 03 00 call 0x38a01 3f: 48 rex.W
reproducer.c
Description: Binary data
reproducer.syz
Description: Binary data
