[PATCH 1/1] tracing/uprobes: Reject unregistering enabled trace_uprobe to prevent UAF

[Ren Wei]

From: Luxiao Xu <rakukuip@xxxxxxxxx>

When unregistering a trace_uprobe, if the probe has a sibling
(i.e. trace_probe_has_sibling() is true), unregister_trace_uprobe()
jumps directly to unreg, bypassing event busy checks and
unregister_uprobe_event().

However, if the trace_uprobe is currently enabled, freeing it without
disabling it allows uprobe callbacks (such as uprobe_dispatcher()) to
continue accessing the freed trace_uprobe structure. This leads to a
use-after-free (UAF) condition.

Fix this by checking trace_probe_is_enabled() at the entry of
unregister_trace_uprobe(). If the probe is enabled, return -EBUSY
immediately to prevent unregistering and freeing an active probe.

Fixes: 41af3cf587f4 ("tracing/uprobe: Add multi-probe per uprobe event support")
Cc: <stable@xxxxxxxxxxxxxxx>
Reported-by: Vega <vega@xxxxxxxxxx>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Luxiao Xu <rakukuip@xxxxxxxxx>
Signed-off-by: Ren Wei <enjou1224z@xxxxxxxxx>
---
 kernel/trace/trace_uprobe.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index c274346853d1..a514a82c4ae0 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -396,6 +396,9 @@ static int unregister_trace_uprobe(struct trace_uprobe *tu)
 {
 	int ret;
 
+	if (trace_probe_is_enabled(&tu->tp))
+		return -EBUSY;
+
 	if (trace_probe_has_sibling(&tu->tp))
 		goto unreg;
 
-- 
2.43.0