[PATCH] tracing/user_events: Clear copied tracing state before fork duplication

[Jérémy Jean]

User events keep per-mm tracing state in task_struct::user_event_mm. It
tracks the registrations and enablers created through the tracefs
user_events_data interface.

dup_task_struct() starts a fork by copying this pointer from the parent.
user_events_fork() must then either share it for CLONE_VM, or create new
state for a child with a separate address space.

The second case can fail. If user_event_mm_dup() cannot allocate the new
state or copy one of its enablers, it returns without replacing the
pointer copied by dup_task_struct(). The child now points at the parent's
tracing state, but did not take a task reference to it.

When the child exits, user_event_mm_remove() can drop the parent's task
count to zero and queue its tracing state for release. The next
user-events registration in the parent calls current_user_event_mm() and
writes to the freed object.

KASAN reports:

    BUG: KASAN: slab-use-after-free in current_user_event_mm+0x51/0x1d0
    Write of size 4 at addr ffff888005010d30 by task init/44

    Call Trace:
     <TASK>
     kasan_report+0xce/0x100
     kasan_check_range+0x10f/0x1e0
     current_user_event_mm+0x51/0x1d0
     user_events_ioctl+0x82e/0x15c0
     __x64_sys_ioctl+0x139/0x1c0
     do_syscall_64+0xce/0x450
     entry_SYSCALL_64_after_hwframe+0x77/0x7f

    Allocated by task 44:
     __kasan_kmalloc+0x8f/0xa0
     __kmalloc_cache_noprof+0x180/0x3a0
     user_event_mm_alloc+0x3c/0x1f0
     current_user_event_mm+0x88/0x1d0

    Freed by task 42:
     __kasan_slab_free+0x43/0x70
     kfree+0x13a/0x390
     process_one_work+0x696/0xf90
     worker_thread+0x420/0xba0

Clear the child's copied user_event_mm before starting the fallible
duplication. If duplication fails, the child has no user-events tracing
state to release. The CLONE_VM case remains unchanged because
user_events_fork() explicitly installs the shared pointer and increments
its task count.

Fixes: 7235759084a4 ("tracing/user_events: Use remote writes for event enablement")
Assisted-by: Codex:gpt-daybreak-blue
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 include/linux/user_events.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/user_events.h b/include/linux/user_events.h
index 57d1ff0..2c9ac7b 100644
--- a/include/linux/user_events.h
+++ b/include/linux/user_events.h
@@ -48,6 +48,7 @@ static inline void user_events_fork(struct task_struct *t,
 		return;
 	}
 
+	t->user_event_mm = NULL;
 	user_event_mm_dup(t, old_mm);
 }
 
-- 
2.47.3