[BUG] tracing: use-after-free in t_start() when a trace instance is removed

[BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Farhad Alemi]

Hello Steven Rostedt, Masami Hiramatsu,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/116-tracing-uaf-t_start-instance-rmdir/

  ==================================================================
  BUG: KASAN: slab-use-after-free in t_next
kernel/trace/trace_events.c:1568 [inline]
  BUG: KASAN: slab-use-after-free in t_start+0xcc/0x210
kernel/trace/trace_events.c:1592
  Read of size 8 at addr ffff888022f7a960 by task syz.4.116/12466
  CPU: 0 UID: 0 PID: 12466 Comm: syz.4.116 Not tainted 7.1.0-rc5 #1
PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Call Trace:
  <TASK>
  dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Steven Rostedt]

On Thu, 27 Aug 2026 23:05:19 +0000
Farhad Alemi <farhad.alemi@berkeley.edu> wrote:

> Hello Steven Rostedt, Masami Hiramatsu,
> 
> While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
> SEFCOM lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/116-tracing-uaf-t_start-instance-rmdir/
> 
>   ==================================================================
>   BUG: KASAN: slab-use-after-free in t_next
> kernel/trace/trace_events.c:1568 [inline]
>   BUG: KASAN: slab-use-after-free in t_start+0xcc/0x210
> kernel/trace/trace_events.c:1592
>   Read of size 8 at addr ffff888022f7a960 by task syz.4.116/12466
>   CPU: 0 UID: 0 PID: 12466 Comm: syz.4.116 Not tainted 7.1.0-rc5 #1
> PREEMPT(full)
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
>   Call Trace:
>   <TASK>
>   dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120
> 
> Our reproducer.c is available upon request.
> 
> Happy to test a patch if that would help.

I see what the problem is. I guess you were creating and removing trace
instances while reading available_events. All files that are part of an
instance needs to get a reference counter on the trace instance when
opened. This prevents the instance from being freed when there are
opened files in it. I see that the available_events file doesn't take
that reference which will allow its instance to be freed while another
task has its content opened. When it reads that content, it will
trigger the bug you see.

I'll work on a fix tomorrow. I'll have to audit the event files to see
if there are any other files that are not taking a reference.

Thanks,

-- Steve

Re: [BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Steven Rostedt]

On Thu, 27 Aug 2026 20:28:59 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> I see what the problem is. I guess you were creating and removing trace
> instances while reading available_events. All files that are part of an
> instance needs to get a reference counter on the trace instance when
> opened. This prevents the instance from being freed when there are
> opened files in it. I see that the available_events file doesn't take
> that reference which will allow its instance to be freed while another
> task has its content opened. When it reads that content, it will
> trigger the bug you see.

It's not available_events, it's the two new files that were added that
didn't take a reference:

  show_event_filters and show_event_triggers

This should fix it:

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 1d39eaf6a0f7..9dbc2441763b 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2736,14 +2736,14 @@ static const struct file_operations ftrace_show_event_filters_fops = {
 	.open = ftrace_event_show_filters_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = seq_release,
+	.release = ftrace_event_release,
 };
 
 static const struct file_operations ftrace_show_event_triggers_fops = {
 	.open = ftrace_event_show_triggers_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = seq_release,
+	.release = ftrace_event_release,
 };
 
 static const struct file_operations ftrace_set_event_pid_fops = {
@@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct file *file)
 static int
 ftrace_event_show_filters_open(struct inode *inode, struct file *file)
 {
-	return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+	struct trace_array *tr = inode->i_private;
+	int ret;
+
+	ret = tracing_check_open_get_tr(tr);
+	if (ret)
+		return ret;
+
+	ret = ftrace_event_open(inode, file, &show_show_event_filters_seq_ops);
+	if (ret < 0)
+		trace_array_put(tr);
+	return ret;
 }
 
 /**
@@ -2922,7 +2932,17 @@ ftrace_event_show_filters_open(struct inode *inode, struct file *file)
 static int
 ftrace_event_show_triggers_open(struct inode *inode, struct file *file)
 {
-	return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
+	struct trace_array *tr = inode->i_private;
+	int ret;
+
+	ret = tracing_check_open_get_tr(tr);
+	if (ret)
+		return ret;
+
+	ret = ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops);
+	if (ret < 0)
+		trace_array_put(tr);
+	return ret;
 }
 
 static int


-- Steve

Re: [BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Steven Rostedt]

On Fri, 28 Aug 2026 09:23:57 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Thu, 27 Aug 2026 20:28:59 -0400
> Steven Rostedt <rostedt@goodmis.org> wrote:
> 
> > I see what the problem is. I guess you were creating and removing trace
> > instances while reading available_events. All files that are part of an
> > instance needs to get a reference counter on the trace instance when
> > opened. This prevents the instance from being freed when there are
> > opened files in it. I see that the available_events file doesn't take
> > that reference which will allow its instance to be freed while another
> > task has its content opened. When it reads that content, it will
> > trigger the bug you see.  
> 
> It's not available_events, it's the two new files that were added that
> didn't take a reference:
> 
>   show_event_filters and show_event_triggers
> 
> This should fix it:
> 

I updated the selftests with this:

diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
index 42422e425107..1e3f27d6998b 100644
--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
@@ -43,6 +43,13 @@ instance_set() {
         done 2> /dev/null
 }
 
+instance_cat() {
+        while :; do
+                cat foo/show_event_filters
+                cat foo/show_event_triggers
+        done 2> /dev/null
+}
+
 instance_slam &
 p1=$!
 echo $p1
@@ -55,14 +62,19 @@ instance_read &
 p3=$!
 echo $p3
 
+instance_cat &
+p4=$!
+echo $p4
+
 sleep 1
 
+kill -1 $p4
 kill -1 $p3
 kill -1 $p2
 kill -1 $p1
 
 echo "Wait for processes to finish"
-wait $p1 $p2 $p3
+wait $p1 $p2 $p3 $p4
 echo "all processes finished, wait for cleanup"
 sleep 1
 


And it was also able to reproduce the issue. With the applied fix, it
doesn't trigger anymore. I'll write up a proper patch.

-- Steve