On Fri, 28 Aug 2026 06:38:17 -0700 Breno Leitao <[email protected]> wrote:
> I am seeing some UAF KASAN issue on ftrace in Meta prod, and I think > I got a reproducer that works ok. > > BUG: KASAN: slab-use-after-free in ftrace_regex_open+0x50/0x770 > Read of size 8 at addr ffff00097627f418 by task stress-ng-fanot/1811644 > > #define TRACEFS "/sys/kernel/tracing" > #define INSTANCE TRACEFS "/instances/uaf" > #define TARGET INSTANCE "/set_ftrace_filter" Ugg, this is similar to the bug I just fixed[1]. But this one will not be so trivial to solve. As the trace_array in question owns the ftrace_ops that is used to register the set_ftrace_filter file. Upping the reference to the trace_array will require some thought. Let me look deeper at it. -- Steve [1] https://lore.kernel.org/all/[email protected]/
