Re: ftrace: UAF in ftrace_regex_open() on a removed tracing instance

[Steven Rostedt]

On Fri, 28 Aug 2026 08:59:39 -0700
Breno Leitao <lei...@debian.org> wrote:

>  ftrace_filter_open(struct inode *inode, struct file *file)
>  {
> -     struct ftrace_ops *ops = inode->i_private;
> +     struct trace_array *tr = inode->i_private;
> +     int ret;
>  
> -     /* Checks for tracefs lockdown */
> -     return ftrace_regex_open(ops,
> -                     FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
> -                     inode, file);
> +     /* Checks for tracefs lockdown, and that the instance is still alive */
> +     ret = tracing_check_open_get_tr(tr);
> +     if (ret)
> +             return ret;
> +
> +     ret = ftrace_regex_open(tr->ops,
> +                             FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES,
> +                             inode, file);
> +     /* ftrace_regex_open() holds its own reference on success */

Hmm, I just noticed this part (from reviewing my own code first, and then
looking at what your AI did).

I guess the issue is that the ops may be freed before you get access to the
trace array. Anyway more needs to be changed. I may remove the extra
reference. No need to do it twice. Also since trace_stack may have the
issue too.

-- Steve


> +     trace_array_put(tr);
> +     return ret;
>  }