CVE-2025-22035

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tracing: Fix use-after-free in print_graph_function_flags during tracer switching<br /> <br /> Kairui reported a UAF issue in print_graph_function_flags() during<br /> ftrace stress testing [1]. This issue can be reproduced if puting a<br /> &amp;#39;mdelay(10)&amp;#39; after &amp;#39;mutex_unlock(&amp;trace_types_lock)&amp;#39; in s_start(),<br /> and executing the following script:<br /> <br /> $ echo function_graph &gt; current_tracer<br /> $ cat trace &gt; /dev/null &amp;<br /> $ sleep 5 # Ensure the &amp;#39;cat&amp;#39; reaches the &amp;#39;mdelay(10)&amp;#39; point<br /> $ echo timerlat &gt; current_tracer<br /> <br /> The root cause lies in the two calls to print_graph_function_flags<br /> within print_trace_line during each s_show():<br /> <br /> * One through &amp;#39;iter-&gt;trace-&gt;print_line()&amp;#39;;<br /> * Another through &amp;#39;event-&gt;funcs-&gt;trace()&amp;#39;, which is hidden in<br /> print_trace_fmt() before print_trace_line returns.<br /> <br /> Tracer switching only updates the former, while the latter continues<br /> to use the print_line function of the old tracer, which in the script<br /> above is print_graph_function_flags.<br /> <br /> Moreover, when switching from the &amp;#39;function_graph&amp;#39; tracer to the<br /> &amp;#39;timerlat&amp;#39; tracer, s_start only calls graph_trace_close of the<br /> &amp;#39;function_graph&amp;#39; tracer to free &amp;#39;iter-&gt;private&amp;#39;, but does not set<br /> it to NULL. This provides an opportunity for &amp;#39;event-&gt;funcs-&gt;trace()&amp;#39;<br /> to use an invalid &amp;#39;iter-&gt;private&amp;#39;.<br /> <br /> To fix this issue, set &amp;#39;iter-&gt;private&amp;#39; to NULL immediately after<br /> freeing it in graph_trace_close(), ensuring that an invalid pointer<br /> is not passed to other tracers. Additionally, clean up the unnecessary<br /> &amp;#39;iter-&gt;private = NULL&amp;#39; during each &amp;#39;cat trace&amp;#39; when using wakeup and<br /> irqsoff tracers.<br /> <br /> [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/