linux-kernel - [GIT PULL] probes: Fixes for v6.17-rc6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250918074652.b9d4842fb41b5bd810b1add7@kernel.org>
Date: Thu, 18 Sep 2025 07:46:52 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Wang Liang <wangliang74@...wei.com>, Steven Rostedt
 <rostedt@...dmis.org>, Masami Hiramatsu <mhiramat@...nel.org>,
 linux-kernel@...r.kernel.org
Subject: [GIT PULL] probes: Fixes for v6.17-rc6

Hi Linus,

Probes fixes for v6.17-rc6:

- kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal(),
  which handles NULL return of kmemdup() correctly.


Please pull the latest probes-fixes-v6.17-rc6 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
probes-fixes-v6.17-rc6

Tag SHA1: 53d1ffce26bf97c7170952518cadb4445b4c1ba7
Head SHA1: dc3382fffdec2c1d6df5836c88fa37b39cd8651e


Wang Liang (1):
      tracing: kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal()

----
 kernel/trace/trace_kprobe.c | 2 ++
 1 file changed, 2 insertions(+)
---------------------------
commit dc3382fffdec2c1d6df5836c88fa37b39cd8651e
Author: Wang Liang <wangliang74@...wei.com>
Date:   Tue Sep 16 15:58:16 2025 +0800

    tracing: kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal()
    
    A crash was observed with the following output:
    
    Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
    KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
    CPU: 1 UID: 0 PID: 2899 Comm: syz.2.399 Not tainted 6.17.0-rc5+ #5 PREEMPT(none)
    RIP: 0010:trace_kprobe_create_internal+0x3fc/0x1440 kernel/trace/trace_kprobe.c:911
    Call Trace:
     <TASK>
     trace_kprobe_create_cb+0xa2/0xf0 kernel/trace/trace_kprobe.c:1089
     trace_probe_create+0xf1/0x110 kernel/trace/trace_probe.c:2246
     dyn_event_create+0x45/0x70 kernel/trace/trace_dynevent.c:128
     create_or_delete_trace_kprobe+0x5e/0xc0 kernel/trace/trace_kprobe.c:1107
     trace_parse_run_command+0x1a5/0x330 kernel/trace/trace.c:10785
     vfs_write+0x2b6/0xd00 fs/read_write.c:684
     ksys_write+0x129/0x240 fs/read_write.c:738
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0x5d/0x2d0 arch/x86/entry/syscall_64.c:94
     </TASK>
    
    Function kmemdup() may return NULL in trace_kprobe_create_internal(), add
    check for it's return value.
    
    Link: https://lore.kernel.org/all/20250916075816.3181175-1-wangliang74@huawei.com/
    
    Fixes: 33b4e38baa03 ("tracing: kprobe-event: Allocate string buffers from heap")
    Signed-off-by: Wang Liang <wangliang74@...wei.com>
    Signed-off-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>

diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index ccae62d4fb91..fa60362a3f31 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -908,6 +908,8 @@ static int trace_kprobe_create_internal(int argc, const char *argv[],
 			return -EINVAL;
 		}
 		buf = kmemdup(&argv[0][1], len + 1, GFP_KERNEL);
+		if (!buf)
+			return -ENOMEM;
 		buf[len] = '\0';
 		ret = kstrtouint(buf, 0, &maxactive);
 		if (ret || !maxactive) {

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>