Subject bpf: Fix UAF due to concurrent consumption of waiting_for_gp_ttrace
Author pulehui@huaweicloud.com
Date 2026-08-26 10:36:15 +0000 UTC
Version
Cc andrii@kernel.org ast@kernel.org bpf@vger.kernel.org daniel@iogearbox.net eddyz87@gmail.com emil@etsalapatis.com ihor.solodrai@linux.dev jolsa@kernel.org linux-kernel@vger.kernel.org martin.lau@linux.dev memxor@gmail.com pulehui@huawei.com pulehui@huaweicloud.com song@kernel.org yonghong.song@linux.dev
Patches (1)
Name Content [All]
[PATCH bpf] bpf: Fix UAF due to concurrent consumption of waiting_for_gp_ttrace [Body]
Series Summary
4 Findings
finding BUG: unable to handle kernel NULL pointer dereference in rcu_core
Log Syz Repro
finding BUG: unable to handle kernel paging request in corrupted
Log Syz Repro
finding WARNING in mntput_no_expire_slowpath
Log Syz Repro
finding kernel BUG in free_percpu
Log Syz Repro
Sessions
Session 2026-08-26
4 Findings
ID (for dev) 6a3e0123-b08d-459d-9068-7f1e60254ccd
Status finished
Triaged OK [Log] [Trajectory]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] passed [Log]
[KASAN] Boot test: Base 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] passed [Log]
[KASAN] Build Patched 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] [patched] passed [Log]
[KASAN] Boot test: Patched 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] [patched] passed [Log]
[KASAN] Fuzz 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] 75b0a6db4300e4c2c9e97a0848deaa7acfb42fb7 [Config] [patched] passed [Log] [Artifacts]
finding BUG: unable to handle kernel NULL pointer dereference in rcu_core
Log Syz Repro
finding BUG: unable to handle kernel paging request in corrupted
Log Syz Repro
finding WARNING in mntput_no_expire_slowpath
Log Syz Repro
finding kernel BUG in free_percpu
Log Syz Repro