[GIT PULL] tracing: Fixes for v6.16

[GIT PULL] tracing: Fixes for v6.16

[Steven Rostedt]

Linus,

tracing fix for 6.16:

- Do not free "head" variable in filter_free_subsystem_filters()

  The first error path jumps to "free_now" label but first frees the newly
  allocated "head" variable. But the "free_now" code checks this variable,
  and if it is not NULL, it will iterate the list. As this list variable
  was already initialized, the "free_now" code will not do anything as it
  is empty. But freeing it will cause a UAF bug. The error path should
  simply jump to the "free_now" label and leave the "head" variable alone.


Please pull the latest trace-v6.16-rc1 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v6.16-rc1

Tag SHA1: 3dec58ebef0af8431ecffae2b1814a11b86dbde1
Head SHA1: 8a157d8a00e815cab4432653cb50c9cedbbb4931


Steven Rostedt (1):
      tracing: Do not free "head" on error path of filter_free_subsystem_filters()

----
 kernel/trace/trace_events_filter.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)
---------------------------
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index ea8b364b6818..08141f105c95 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1437,10 +1437,8 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir,
 	INIT_LIST_HEAD(&head->list);
 
 	item = kmalloc(sizeof(*item), GFP_KERNEL);
-	if (!item) {
-		kfree(head);
+	if (!item)
 		goto free_now;
-	}
 
 	item->filter = filter;
 	list_add_tail(&item->list, &head->list);

Re: [GIT PULL] tracing: Fixes for v6.16

[Linus Torvalds]

On Fri, 13 Jun 2025 at 08:50, Steven Rostedt <rostedt@goodmis.org> wrote:
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
> trace-v6.16-rc1
>
> Tag SHA1: 3dec58ebef0af8431ecffae2b1814a11b86dbde1
> Head SHA1: 8a157d8a00e815cab4432653cb50c9cedbbb4931

I see the HEAD in the 'trace/fixes' branch, but no tags anywhere.
Forgot to push?

               Linus

Re: [GIT PULL] tracing: Fixes for v6.16

[Steven Rostedt]

On Fri, 13 Jun 2025 10:05:17 -0700
Linus Torvalds <torvalds@linux-foundation.org> wrote:


> I see the HEAD in the 'trace/fixes' branch, but no tags anywhere.
> Forgot to push?

Yep. Sorry about that.

I just pushed it now.

-- Steve

Re: [GIT PULL] tracing: Fixes for v6.16

[pr-tracker-bot]

The pull request you sent on Sat, 28 Jun 2025 09:49:47 -0400:

> git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace-v6.16-rc3

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/ded779017ad78fc9df3e9d9ae0e39d2e73865851

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL] tracing: Fixes for v6.16

[Steven Rostedt]

Linus,

tracing fixes for v6.16:

- Fix possible UAF on error path in filter_free_subsystem_filters()

  When freeing a subsystem filter, the filter for the subsystem is passed in
  to be freed and all the events within the subsystem will have their filter
  freed too. In order to free without waiting for RCU synchronization, list
  items are allocated to hold what is going to be freed to free it via a
  call_rcu(). If the allocation of these items fails, it will call the
  synchronization directly and free after that (causing a bit of delay for
  the user).

  The subsystem filter is first added to this list and then the filters for
  all the events under the subsystem. The bug is if one of the allocations
  of the list items for the event filters fail to allocate, it jumps to the
  "free_now" label which will free the subsystem filter, then all the items
  on the allocated list, and then the event filters that were not added to
  the list yet. But because the subsystem filter was added first, it gets
  freed twice.

  The solution is to add the subsystem filter after the events, and then if
  any of the allocations fail it will not try to free any of them twice


Please pull the latest trace-v6.16-rc3 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v6.16-rc3

Tag SHA1: 361daeb581d92db7327cbdb0b00bce50057101f8
Head SHA1: 6921d1e07cb5eddec830801087b419194fde0803


Edward Adam Davis (1):
      tracing: Fix filter logic error

----
 kernel/trace/trace_events_filter.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
---------------------------
commit 6921d1e07cb5eddec830801087b419194fde0803
Author: Edward Adam Davis <eadavis@qq.com>
Date:   Tue Jun 24 14:38:46 2025 +0800

    tracing: Fix filter logic error
    
    If the processing of the tr->events loop fails, the filter that has been
    added to filter_head will be released twice in free_filter_list(&head->rcu)
    and __free_filter(filter).
    
    After adding the filter of tr->events, add the filter to the filter_head
    process to avoid triggering uaf.
    
    Link: https://lore.kernel.org/tencent_4EF87A626D702F816CD0951CE956EC32CD0A@qq.com
    Fixes: a9d0aab5eb33 ("tracing: Fix regression of filter waiting a long time on RCU synchronization")
    Reported-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=daba72c4af9915e9c894
    Tested-by: syzbot+daba72c4af9915e9c894@syzkaller.appspotmail.com
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Signed-off-by: Edward Adam Davis <eadavis@qq.com>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 08141f105c95..3885aadc434d 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1436,13 +1436,6 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir,
 
 	INIT_LIST_HEAD(&head->list);
 
-	item = kmalloc(sizeof(*item), GFP_KERNEL);
-	if (!item)
-		goto free_now;
-
-	item->filter = filter;
-	list_add_tail(&item->list, &head->list);
-
 	list_for_each_entry(file, &tr->events, list) {
 		if (file->system != dir)
 			continue;
@@ -1454,6 +1447,13 @@ static void filter_free_subsystem_filters(struct trace_subsystem_dir *dir,
 		event_clear_filter(file);
 	}
 
+	item = kmalloc(sizeof(*item), GFP_KERNEL);
+	if (!item)
+		goto free_now;
+
+	item->filter = filter;
+	list_add_tail(&item->list, &head->list);
+
 	delay_free_filter(head);
 	return;
  free_now:

Re: [GIT PULL] tracing: Fixes for v6.16

[pr-tracker-bot]

The pull request you sent on Tue, 3 Jun 2025 15:59:09 -0400:

> git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace-v6.16-2

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/70087d2200d4a3bd31812ab4578c9ec70ea344af

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html

[GIT PULL] tracing: Fixes for v6.16

[Steven Rostedt]

Linus,

tracing fixes:

- Fix UAF in module unload in ftrace when there's a bug in the module

  If a module is buggy and triggers ftrace_disable which is set when
  an anomaly is detected, when it gets unloaded it doesn't free
  the hooks into kallsyms, and when a kallsyms lookup is performed
  it may access the mod->modname field and crash via UAF.

  Fix this by still freeing the mod_maps that are attached to kallsyms
  on module unload regardless if ftrace_disable is set or not.

- Do not bother allocating mod_maps for kallsyms if ftrace_disable is set

- Remove unused trace events

  When a trace event or tracepoint is created but not used, it still
  creates the code and data structures needed for that trace event.
  This just wastes memory.

  A patch is being worked on to warn when a trace event is created but
  not used: https://lore.kernel.org/linux-trace-kernel/20250529130138.544ffec4@gandalf.local.home/

  Remove the trace events that are created but not used. This does not
  remove trace events that are created but are not used due to configs
  not being set. That will be handled later. This only removes events
  that have no user under any config.


Please pull the latest trace-v6.16-2 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v6.16-2

Tag SHA1: 5742e05e28abea97c94cb020c894fee830d34f1d
Head SHA1: a4a45a9a72f3a9eaa17ec502d6e97c8eaa901825


Steven Rostedt (3):
      xdp: Remove unused mem_return_failed event
      genirq/matrix: Remove unused irq_matrix_alloc_reserved tracepoint
      fsdax: Remove unused trace events for dax insert mapping

Ye Bin (2):
      ftrace: Fix UAF when lookup kallsym after ftrace disabled
      ftrace: Don't allocate ftrace module map if ftrace is disabled

----
 include/trace/events/fs_dax.h     | 78 ---------------------------------------
 include/trace/events/irq_matrix.h |  8 ----
 include/trace/events/xdp.h        | 26 -------------
 kernel/trace/ftrace.c             | 13 +++++--
 4 files changed, 10 insertions(+), 115 deletions(-)
---------------------------
diff --git a/include/trace/events/fs_dax.h b/include/trace/events/fs_dax.h
index 86fe6aecff1e..76b56f78abb0 100644
--- a/include/trace/events/fs_dax.h
+++ b/include/trace/events/fs_dax.h
@@ -102,54 +102,6 @@ DEFINE_EVENT(dax_pmd_load_hole_class, name, \
 DEFINE_PMD_LOAD_HOLE_EVENT(dax_pmd_load_hole);
 DEFINE_PMD_LOAD_HOLE_EVENT(dax_pmd_load_hole_fallback);
 
-DECLARE_EVENT_CLASS(dax_pmd_insert_mapping_class,
-	TP_PROTO(struct inode *inode, struct vm_fault *vmf,
-		long length, pfn_t pfn, void *radix_entry),
-	TP_ARGS(inode, vmf, length, pfn, radix_entry),
-	TP_STRUCT__entry(
-		__field(unsigned long, ino)
-		__field(unsigned long, vm_flags)
-		__field(unsigned long, address)
-		__field(long, length)
-		__field(u64, pfn_val)
-		__field(void *, radix_entry)
-		__field(dev_t, dev)
-		__field(int, write)
-	),
-	TP_fast_assign(
-		__entry->dev = inode->i_sb->s_dev;
-		__entry->ino = inode->i_ino;
-		__entry->vm_flags = vmf->vma->vm_flags;
-		__entry->address = vmf->address;
-		__entry->write = vmf->flags & FAULT_FLAG_WRITE;
-		__entry->length = length;
-		__entry->pfn_val = pfn.val;
-		__entry->radix_entry = radix_entry;
-	),
-	TP_printk("dev %d:%d ino %#lx %s %s address %#lx length %#lx "
-			"pfn %#llx %s radix_entry %#lx",
-		MAJOR(__entry->dev),
-		MINOR(__entry->dev),
-		__entry->ino,
-		__entry->vm_flags & VM_SHARED ? "shared" : "private",
-		__entry->write ? "write" : "read",
-		__entry->address,
-		__entry->length,
-		__entry->pfn_val & ~PFN_FLAGS_MASK,
-		__print_flags_u64(__entry->pfn_val & PFN_FLAGS_MASK, "|",
-			PFN_FLAGS_TRACE),
-		(unsigned long)__entry->radix_entry
-	)
-)
-
-#define DEFINE_PMD_INSERT_MAPPING_EVENT(name) \
-DEFINE_EVENT(dax_pmd_insert_mapping_class, name, \
-	TP_PROTO(struct inode *inode, struct vm_fault *vmf, \
-		long length, pfn_t pfn, void *radix_entry), \
-	TP_ARGS(inode, vmf, length, pfn, radix_entry))
-
-DEFINE_PMD_INSERT_MAPPING_EVENT(dax_pmd_insert_mapping);
-
 DECLARE_EVENT_CLASS(dax_pte_fault_class,
 	TP_PROTO(struct inode *inode, struct vm_fault *vmf, int result),
 	TP_ARGS(inode, vmf, result),
@@ -194,36 +146,6 @@ DEFINE_PTE_FAULT_EVENT(dax_load_hole);
 DEFINE_PTE_FAULT_EVENT(dax_insert_pfn_mkwrite_no_entry);
 DEFINE_PTE_FAULT_EVENT(dax_insert_pfn_mkwrite);
 
-TRACE_EVENT(dax_insert_mapping,
-	TP_PROTO(struct inode *inode, struct vm_fault *vmf, void *radix_entry),
-	TP_ARGS(inode, vmf, radix_entry),
-	TP_STRUCT__entry(
-		__field(unsigned long, ino)
-		__field(unsigned long, vm_flags)
-		__field(unsigned long, address)
-		__field(void *, radix_entry)
-		__field(dev_t, dev)
-		__field(int, write)
-	),
-	TP_fast_assign(
-		__entry->dev = inode->i_sb->s_dev;
-		__entry->ino = inode->i_ino;
-		__entry->vm_flags = vmf->vma->vm_flags;
-		__entry->address = vmf->address;
-		__entry->write = vmf->flags & FAULT_FLAG_WRITE;
-		__entry->radix_entry = radix_entry;
-	),
-	TP_printk("dev %d:%d ino %#lx %s %s address %#lx radix_entry %#lx",
-		MAJOR(__entry->dev),
-		MINOR(__entry->dev),
-		__entry->ino,
-		__entry->vm_flags & VM_SHARED ? "shared" : "private",
-		__entry->write ? "write" : "read",
-		__entry->address,
-		(unsigned long)__entry->radix_entry
-	)
-)
-
 DECLARE_EVENT_CLASS(dax_writeback_range_class,
 	TP_PROTO(struct inode *inode, pgoff_t start_index, pgoff_t end_index),
 	TP_ARGS(inode, start_index, end_index),
diff --git a/include/trace/events/irq_matrix.h b/include/trace/events/irq_matrix.h
index 267d4cbbf360..93244078b4e6 100644
--- a/include/trace/events/irq_matrix.h
+++ b/include/trace/events/irq_matrix.h
@@ -138,14 +138,6 @@ DEFINE_EVENT(irq_matrix_global_update, irq_matrix_assign_system,
 	TP_ARGS(bit, matrix)
 );
 
-DEFINE_EVENT(irq_matrix_cpu, irq_matrix_alloc_reserved,
-
-	TP_PROTO(int bit, unsigned int cpu,
-		 struct irq_matrix *matrix, struct cpumap *cmap),
-
-	TP_ARGS(bit, cpu, matrix, cmap)
-);
-
 DEFINE_EVENT(irq_matrix_cpu, irq_matrix_reserve_managed,
 
 	TP_PROTO(int bit, unsigned int cpu,
diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
index a7e5452b5d21..d3ef86c97ae3 100644
--- a/include/trace/events/xdp.h
+++ b/include/trace/events/xdp.h
@@ -379,32 +379,6 @@ TRACE_EVENT(mem_connect,
 	)
 );
 
-TRACE_EVENT(mem_return_failed,
-
-	TP_PROTO(const struct xdp_mem_info *mem,
-		 const struct page *page),
-
-	TP_ARGS(mem, page),
-
-	TP_STRUCT__entry(
-		__field(const struct page *,	page)
-		__field(u32,		mem_id)
-		__field(u32,		mem_type)
-	),
-
-	TP_fast_assign(
-		__entry->page		= page;
-		__entry->mem_id		= mem->id;
-		__entry->mem_type	= mem->type;
-	),
-
-	TP_printk("mem_id=%d mem_type=%s page=%p",
-		  __entry->mem_id,
-		  __print_symbolic(__entry->mem_type, __MEM_TYPE_SYM_TAB),
-		  __entry->page
-	)
-);
-
 TRACE_EVENT(bpf_xdp_link_attach_failed,
 
 	TP_PROTO(const char *msg),
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 1af952cba48d..a7291685902e 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -7438,9 +7438,10 @@ void ftrace_release_mod(struct module *mod)
 
 	mutex_lock(&ftrace_lock);
 
-	if (ftrace_disabled)
-		goto out_unlock;
-
+	/*
+	 * To avoid the UAF problem after the module is unloaded, the
+	 * 'mod_map' resource needs to be released unconditionally.
+	 */
 	list_for_each_entry_safe(mod_map, n, &ftrace_mod_maps, list) {
 		if (mod_map->mod == mod) {
 			list_del_rcu(&mod_map->list);
@@ -7449,6 +7450,9 @@ void ftrace_release_mod(struct module *mod)
 		}
 	}
 
+	if (ftrace_disabled)
+		goto out_unlock;
+
 	/*
 	 * Each module has its own ftrace_pages, remove
 	 * them from the list.
@@ -7627,6 +7631,9 @@ allocate_ftrace_mod_map(struct module *mod,
 {
 	struct ftrace_mod_map *mod_map;
 
+	if (ftrace_disabled)
+		return NULL;
+
 	mod_map = kmalloc(sizeof(*mod_map), GFP_KERNEL);
 	if (!mod_map)
 		return NULL;