linux-kernel - Re: [PATCH] tracing: kprobe-event: Fix null-ptr-deref in trace_kprobe_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250917223630.f936f6e71964037f07a33838@kernel.org>
Date: Wed, 17 Sep 2025 22:36:30 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Wang Liang <wangliang74@...wei.com>
Cc: <rostedt@...dmis.org>, <mathieu.desnoyers@...icios.com>,
 <yuehaibing@...wei.com>, <zhangchangzhong@...wei.com>,
 <linux-kernel@...r.kernel.org>, <linux-trace-kernel@...r.kernel.org>
Subject: Re: [PATCH] tracing: kprobe-event: Fix null-ptr-deref in
 trace_kprobe_create_internal()

On Tue, 16 Sep 2025 15:58:16 +0800
Wang Liang <wangliang74@...wei.com> wrote:

> A crash was observed with the following output:
> 
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
> CPU: 1 UID: 0 PID: 2899 Comm: syz.2.399 Not tainted 6.17.0-rc5+ #5 PREEMPT(none)
> RIP: 0010:trace_kprobe_create_internal+0x3fc/0x1440 kernel/trace/trace_kprobe.c:911
> Call Trace:
>  <TASK>
>  trace_kprobe_create_cb+0xa2/0xf0 kernel/trace/trace_kprobe.c:1089
>  trace_probe_create+0xf1/0x110 kernel/trace/trace_probe.c:2246
>  dyn_event_create+0x45/0x70 kernel/trace/trace_dynevent.c:128
>  create_or_delete_trace_kprobe+0x5e/0xc0 kernel/trace/trace_kprobe.c:1107
>  trace_parse_run_command+0x1a5/0x330 kernel/trace/trace.c:10785
>  vfs_write+0x2b6/0xd00 fs/read_write.c:684
>  ksys_write+0x129/0x240 fs/read_write.c:738
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x5d/0x2d0 arch/x86/entry/syscall_64.c:94
>  </TASK>
> 
> Function kmemdup() may return NULL in trace_kprobe_create_internal(), add
> check for it's return value.

Oops, thanks for fixing!
Let me pick this!

> 
> Fixes: 33b4e38baa03 ("tracing: kprobe-event: Allocate string buffers from heap")
> Signed-off-by: Wang Liang <wangliang74@...wei.com>
> ---
>  kernel/trace/trace_kprobe.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
> index ccae62d4fb91..fa60362a3f31 100644
> --- a/kernel/trace/trace_kprobe.c
> +++ b/kernel/trace/trace_kprobe.c
> @@ -908,6 +908,8 @@ static int trace_kprobe_create_internal(int argc, const char *argv[],
>  			return -EINVAL;
>  		}
>  		buf = kmemdup(&argv[0][1], len + 1, GFP_KERNEL);
> +		if (!buf)
> +			return -ENOMEM;
>  		buf[len] = '\0';
>  		ret = kstrtouint(buf, 0, &maxactive);
>  		if (ret || !maxactive) {
> -- 
> 2.34.1
> 


-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>