On Fri, Aug 28, 2026 at 10:42:01AM -0400, Steven Rostedt wrote:
> On Fri, 28 Aug 2026 06:38:17 -0700
> Breno Leitao <[email protected]> wrote:
>
> > I am seeing some UAF KASAN issue on ftrace in Meta prod, and I think
> > I got a reproducer that works ok.
> >
> > BUG: KASAN: slab-use-after-free in ftrace_regex_open+0x50/0x770
> > Read of size 8 at addr ffff00097627f418 by task stress-ng-fanot/1811644
>
> >
> > #define TRACEFS "/sys/kernel/tracing"
> > #define INSTANCE TRACEFS "/instances/uaf"
> > #define TARGET INSTANCE "/set_ftrace_filter"
>
> Ugg, this is similar to the bug I just fixed[1]. But this one will not be
> so trivial to solve. As the trace_array in question owns the ftrace_ops
> that is used to register the set_ftrace_filter file. Upping the reference
> to the trace_array will require some thought.
>
> Let me look deeper at it.
My LLM came up with something like the following, and it doesn't
reproduce the problem anymore. Very similar to your code above:
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f9d80c7bd9f16..37845399fe5cf 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4788,22 +4788,37 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag,
static int
ftrace_filter_open(struct inode *inode, struct file *file)
{
- struct ftrace_ops *ops = inode->i_private;
+ struct trace_array *tr = inode->i_private;
+ int ret;
- /* Checks for tracefs lockdown */
- return ftrace_regex_open(ops,
- FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
- inode, file);
+ /* Checks for tracefs lockdown, and that the instance is still alive */
+ ret = tracing_check_open_get_tr(tr);
+ if (ret)
+ return ret;
+
+ ret = ftrace_regex_open(tr->ops,
+ FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
+ inode, file);
+ /* ftrace_regex_open() holds its own reference on success */
+ trace_array_put(tr);
+ return ret;
}
static int
ftrace_notrace_open(struct inode *inode, struct file *file)
{
- struct ftrace_ops *ops = inode->i_private;
+ struct trace_array *tr = inode->i_private;
+ int ret;
+
+ /* Checks for tracefs lockdown, and that the instance is still alive */
+ ret = tracing_check_open_get_tr(tr);
+ if (ret)
+ return ret;
- /* Checks for tracefs lockdown */
- return ftrace_regex_open(ops, FTRACE_ITER_NOTRACE,
- inode, file);
+ ret = ftrace_regex_open(tr->ops, FTRACE_ITER_NOTRACE, inode, file);
+ /* ftrace_regex_open() holds its own reference on success */
+ trace_array_put(tr);
+ return ret;
}
/* Type for quick search ftrace basic regexes (globs) from filter_parse_regex
*/
@@ -7496,11 +7511,15 @@ void ftrace_create_filter_files(struct ftrace_ops *ops,
struct dentry *parent)
{
+ /*
+ * Pass the trace array and not @ops, as @ops is freed when the
+ * instance is removed, but the trace array can still be validated.
+ */
trace_create_file("set_ftrace_filter", TRACE_MODE_WRITE, parent,
- ops, &ftrace_filter_fops);
+ ops->private, &ftrace_filter_fops);
trace_create_file("set_ftrace_notrace", TRACE_MODE_WRITE, parent,
- ops, &ftrace_notrace_fops);
+ ops->private, &ftrace_notrace_fops);
}
/*
