{"id":"CVE-2022-49892","summary":"ftrace: Fix use-after-free for dynamic ftrace_ops","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nftrace: Fix use-after-free for dynamic ftrace_ops\n\nKASAN reported a use-after-free with ftrace ops [1]. It was found from\nvmcore that perf had registered two ops with the same content\nsuccessively, both dynamic. After unregistering the second ops, a\nuse-after-free occurred.\n\nIn ftrace_shutdown(), when the second ops is unregistered, the\nFTRACE_UPDATE_CALLS command is not set because there is another enabled\nops with the same content.  Also, both ops are dynamic and the ftrace\ncallback function is ftrace_ops_list_func, so the\nFTRACE_UPDATE_TRACE_FUNC command will not be set. Eventually the value\nof 'command' will be 0 and ftrace_shutdown() will skip the rcu\nsynchronization.\n\nHowever, ftrace may be activated. When the ops is released, another CPU\nmay be accessing the ops.  Add the missing synchronization to fix this\nproblem.\n\n[1]\nBUG: KASAN: use-after-free in __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\nBUG: KASAN: use-after-free in ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\nRead of size 8 at addr ffff56551965bbc8 by task syz-executor.2/14468\n\nCPU: 1 PID: 14468 Comm: syz-executor.2 Not tainted 5.10.0 #7\nHardware name: linux,dummy-virt (DT)\nCall trace:\n dump_backtrace+0x0/0x40c arch/arm64/kernel/stacktrace.c:132\n show_stack+0x30/0x40 arch/arm64/kernel/stacktrace.c:196\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x1b4/0x248 lib/dump_stack.c:118\n print_address_description.constprop.0+0x28/0x48c mm/kasan/report.c:387\n __kasan_report mm/kasan/report.c:547 [inline]\n kasan_report+0x118/0x210 mm/kasan/report.c:564\n check_memory_region_inline mm/kasan/generic.c:187 [inline]\n __asan_load8+0x98/0xc0 mm/kasan/generic.c:253\n __ftrace_ops_list_func kernel/trace/ftrace.c:7020 [inline]\n ftrace_ops_list_func+0x2b0/0x31c kernel/trace/ftrace.c:7049\n ftrace_graph_call+0x0/0x4\n __might_sleep+0x8/0x100 include/linux/perf_event.h:1170\n __might_fault mm/memory.c:5183 [inline]\n __might_fault+0x58/0x70 mm/memory.c:5171\n do_strncpy_from_user lib/strncpy_from_user.c:41 [inline]\n strncpy_from_user+0x1f4/0x4b0 lib/strncpy_from_user.c:139\n getname_flags+0xb0/0x31c fs/namei.c:149\n getname+0x2c/0x40 fs/namei.c:209\n [...]\n\nAllocated by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track mm/kasan/common.c:56 [inline]\n __kasan_kmalloc mm/kasan/common.c:479 [inline]\n __kasan_kmalloc.constprop.0+0x110/0x13c mm/kasan/common.c:449\n kasan_kmalloc+0xc/0x14 mm/kasan/common.c:493\n kmem_cache_alloc_trace+0x440/0x924 mm/slub.c:2950\n kmalloc include/linux/slab.h:563 [inline]\n kzalloc include/linux/slab.h:675 [inline]\n perf_event_alloc.part.0+0xb4/0x1350 kernel/events/core.c:11230\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n __arm64_sys_perf_event_open+0x6c/0x80 kernel/events/core.c:11723\n [...]\n\nFreed by task 14445:\n kasan_save_stack+0x24/0x50 mm/kasan/common.c:48\n kasan_set_track+0x24/0x34 mm/kasan/common.c:56\n kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:358\n __kasan_slab_free.part.0+0x11c/0x1b0 mm/kasan/common.c:437\n __kasan_slab_free mm/kasan/common.c:445 [inline]\n kasan_slab_free+0x2c/0x40 mm/kasan/common.c:446\n slab_free_hook mm/slub.c:1569 [inline]\n slab_free_freelist_hook mm/slub.c:1608 [inline]\n slab_free mm/slub.c:3179 [inline]\n kfree+0x12c/0xc10 mm/slub.c:4176\n perf_event_alloc.part.0+0xa0c/0x1350 kernel/events/core.c:11434\n perf_event_alloc kernel/events/core.c:11733 [inline]\n __do_sys_perf_event_open kernel/events/core.c:11831 [inline]\n __se_sys_perf_event_open+0x550/0x15f4 kernel/events/core.c:11723\n [...]","modified":"2026-05-18T05:55:18.362737251Z","published":"2025-05-01T14:10:35.815Z","related":["SUSE-SU-2025:01918-1","SUSE-SU-2025:01966-1","SUSE-SU-2025:01982-1","SUSE-SU-2025:01983-1","SUSE-SU-2025:01995-1","SUSE-SU-2025:02173-1","SUSE-SU-2025:02262-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49892.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0e792b89e6800cd9cb4757a76a96f7ef3e8b6294"},{"type":"WEB","url":"https://git.kernel.org/stable/c/88561a66777e7a2fe06638c6dcb22a9fae0b6733"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ea5f2fd4640ecbb9df969bf8bb27733ae2183169"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49892.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-49892"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"edb096e00724f02db5f6ec7900f3bbd465c6c76f"},{"fixed":"ea5f2fd4640ecbb9df969bf8bb27733ae2183169"},{"fixed":"88561a66777e7a2fe06638c6dcb22a9fae0b6733"},{"fixed":"cc1b9961a0ceb70f6ca4e2f4b8bb71c87c7a495c"},{"fixed":"0e792b89e6800cd9cb4757a76a96f7ef3e8b6294"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"a60e407b961e818541ff7924afa8e51fbdb21a61"},{"last_affected":"ed1bf4397d2219d4b9ec2d5517416ba102186650"},{"last_affected":"100553e197e2c41eccf9fa04b2be9cd11ae21215"},{"last_affected":"30d3c1c9c9dd31b3c3a5aa0f4f40f1e321c6c791"}]}],"versions":["v4.13","v4.1.44","v4.13.3","v4.9.51","v4.4.88","v4.13-rc2","v4.13.2","v4.9.50","v4.13.1","v4.9.49","v4.4.87","v4.9.48","v4.13-rc1","v4.13-rc3","v4.9.47","v4.4.86","v4.13-rc7","v4.9.46","v4.4.85","v4.1.43","v4.13-rc4","v4.13-rc5","v4.13-rc6","v4.9.45","v4.4.84","v4.9.44","v4.4.83","v4.9.43","v4.4.82","v4.9.42","v4.4.81","v4.4.80","v4.9.41","v4.4.79","v4.9.40","v4.12-rc1","v4.9.39","v4.4.78","v4.1.42","v4.12","v4.4.77","v4.9.38","v4.9.37","v4.4.76","v4.12-rc5","v4.9.36","v4.12-rc7","v4.9.35","v4.4.75","v4.12-rc6","v4.12-rc4","v4.9.34","v4.4.74","v4.12-rc2","v4.4.73","v4.1.41","v4.9.33","v4.12-rc3","v4.9.32","v4.4.72","v4.11","v4.9.31","v4.4.71","v4.1.40","v4.9.30","v4.4.70","v4.9.29","v4.4.69","v4.9.28","v4.4.68","v4.1.39","v4.9.27","v4.4.67","v4.11-rc1","v4.9.26","v4.4.66","v4.11-rc6","v4.9.25","v4.4.65","v4.11-rc8","v4.4.64","v4.9.24","v4.4.63","v4.11-rc7","v4.11-rc3","v4.9.23","v4.4.62","v4.11-rc5","v4.11-rc2","v4.4.61","v4.9.22","v4.11-rc4","v4.9.21","v4.4.60","v4.4.59","v4.9.20","v4.9.19","v4.4.58","v4.9.18","v4.4.57","v4.10","v4.9.17","v4.4.56","v4.9.16","v4.4.55","v4.9.15","v4.4.54","v4.9.14","v4.4.53","v4.9.13","v4.4.52","v4.1.38","v4.9","v4.9.12","v4.4.51","v4.9.11","v4.4.50","v4.10-rc8","v4.10-rc3","v4.10-rc1","v4.10-rc7","v4.4.49","v4.9.10","v4.10-rc6","v4.10-rc2","v4.9.9","v4.4.48","v4.10-rc5","v4.9.8","v4.4.47","v4.9.7","v4.4.46","v4.9.6","v4.4.45","v4.10-rc4","v4.9.5","v4.4.44","v4.9.4","v4.4.43","v4.9.3","v4.4.42","v4.1.37","v4.9.2","v4.4.41","v4.9.1","v4.4.40","v4.4.39","v4.1.36","v4.9-rc7","v4.9-rc6","v4.9-rc8","v4.4.38","v4.9-rc1","v4.4.37","v4.9-rc5","v4.4.36","v4.9-rc3","v4.4.35","v4.9-rc4","v4.4.34","v4.9-rc2","v4.4.33","v4.4.32","v4.4.31","v4.4.30","v4.8","v4.4.29","v4.4.28","v4.1.35","v4.4.27","v4.1.34","v4.4.26","v4.4.25","v4.4.24","v4.4.23","v4.8-rc8","v4.8-rc2","v4.8-rc1","v4.8-rc7","v4.4.22","v4.8-rc6","v4.8-rc5","v4.4.21","v4.1.33","v4.8-rc4","v4.4.20","v4.8-rc3","v4.1.32","v4.7","v4.4.19","v4.1.31","v4.4.18","v4.4.17","v4.1.30","v4.4.16","v4.7-rc4","v4.1.29","v4.7-rc2","v4.4.15","v4.7-rc1","v4.7-rc7","v4.7-rc6","v4.1.28","v4.7-rc3","v4.4.14","v4.1.27","v4.7-rc5","v4.4.13","v4.6","v4.1.26","v4.6-rc1","v4.4.12","v4.4.11","v4.1.25","v4.6-rc6","v4.6-rc4","v4.6-rc7","v4.4.10","v4.6-rc5","v4.5-rc4","v4.1.24","v4.6-rc2","v4.4.9","v4.6-rc3","v4.1.23","v4.4.8","v4.5","v4.4.7","v4.1.22","v4.4.6","v4.1.21","v4.4","v4.5-rc1","v4.5-rc6","v4.1.20","v4.4.5","v4.5-rc2","v4.5-rc7","v4.5-rc5","v4.4.4","v4.5-rc3","v4.1.19","v4.4.3","v4.4.2","v4.1.18","v4.4.1","v4.1.17","v4.1.16","v4.1.15","v4.4-rc1","v4.4-rc2","v4.4-rc8","v4.4-rc3","v4.4-rc7","v4.4-rc5","v4.4-rc6","v4.4-rc4","v4.3","v4.1.14","v4.1.13","v4.3-rc1","v4.1.12","v4.3-rc6","v4.3-rc4","v4.3-rc2","v4.3-rc7","v4.3-rc5","v4.3-rc3","v4.1.11","v4.1.10","v4.2","v4.1.9","v4.1.8","v4.1.7","v4.1.6","v4.2-rc2","v4.2-rc1","v4.2-rc8","v4.2-rc4","v4.2-rc6","v4.2-rc7","v4.0-rc5","v4.1.5","v4.2-rc5","v4.1.4","v4.2-rc3","v4.1.3","v4.1.2","v4.1-rc2","v4.1","v4.1.1","v4.1-rc1","v4.1-rc8","v4.1-rc7","v4.1-rc6","v4.1-rc3","v4.1-rc4","v4.0","v4.1-rc5","v4.0-rc1","v4.0-rc2","v4.0-rc7","v4.0-rc3","v4.0-rc6","v4.0-rc4","v3.19","v3.19-rc7","v3.19-rc5","v3.19-rc1","v3.19-rc6","v3.19-rc4","v3.18-rc1","v3.19-rc3","v3.19-rc2","v3.18","v3.18-rc7","v3.18-rc6","v3.18-rc2","v3.18-rc3","v3.18-rc4","v3.18-rc5","v3.17","v3.17-rc1","v3.17-rc7","v3.17-rc2","v3.17-rc4","v3.16","v3.17-rc5","v3.17-rc6","v3.17-rc3","v3.16-rc7","v3.16-rc1","v3.16-rc3","v3.16-rc5","v3.16-rc6","v3.16-rc2","v3.16-rc4","v3.13","v3.15","v3.15-rc5","v3.15-rc8","v3.15-rc1","v3.15-rc6","v3.15-rc3","v3.15-rc7","v3.15-rc2","v3.15-rc4","v3.14","v3.14-rc4","v3.14-rc8","v3.14-rc7","v3.14-rc6","v3.14-rc1","v3.14-rc2","v3.14-rc5","v3.14-rc3","v3.13-rc6","v3.13-rc8","v3.12","v3.13-rc7","v3.13-rc1","v3.13-rc4","v3.13-rc3","v3.13-rc5","v3.13-rc2","v3.12-rc7","v3.12-rc3","v3.12-rc6","v3.12-rc1","v3.12-rc5","v3.11","v3.12-rc2","v3.12-rc4","v3.11-rc7","v3.11-rc2","v3.11-rc5","v3.11-rc1","v3.11-rc3","v3.11-rc4","v3.11-rc6","v3.10-rc2","v3.10","v3.10-rc7","v3.10-rc6","v3.10-rc1","v3.10-rc5","v3.10-rc3","v3.10-rc4","v3.9","v3.9-rc2","v3.9-rc7","v3.9-rc8","v3.9-rc3","v3.9-rc6","v3.9-rc5","v3.9-rc4","v3.9-rc1","v3.8","v3.8-rc7","v3.8-rc6","v3.8-rc5","v3.8-rc2","v3.8-rc1","v3.8-rc3","v3.8-rc4","v3.7","v3.7-rc1","v3.6","v3.7-rc6","v3.7-rc7","v3.7-rc3","v3.7-rc8","v3.7-rc2","v3.7-rc4","v3.7-rc5","v3.6-rc7","v3.6-rc1","v3.5-rc3","v3.6-rc6","v3.6-rc5","v3.5","v3.6-rc3","v3.6-rc4","v3.6-rc2","v3.4-rc4","v3.5-rc7","v3.5-rc5","v3.5-rc6","v3.5-rc2","v3.5-rc1","v3.5-rc4","v3.4","v3.4-rc2","v3.4-rc1","v3.4-rc7","v3.4-rc6","v3.4-rc3","v3.4-rc5","v3.3","v3.3-rc6","v3.3-rc3","v3.3-rc7","v3.3-rc2","v3.3-rc5","v3.2","v3.3-rc4","v3.3-rc1","v3.2-rc4","v3.2-rc7","v3.2-rc6","v3.2-rc5","v3.2-rc3","v3.1","v3.2-rc2","v3.2-rc1","v3.1-rc1","v3.1-rc9","v3.1-rc8","v3.1-rc10","v3.1-rc7","v3.1-rc3","v3.1-rc2","v3.1-rc4","v3.1-rc5","v3.0","v3.1-rc6","v3.0-rc7","v3.0-rc4","v3.0-rc6","v3.0-rc5","v3.0-rc3","v3.0-rc1","v2.6.39","v3.0-rc2","v2.6.38","v2.6.39-rc2","v2.6.39-rc7","v2.6.39-rc5","v2.6.39-rc1","v2.6.38-rc7","v2.6.39-rc6","v2.6.39-rc4","v2.6.39-rc3","v2.6.37","v2.6.38-rc1","v2.6.38-rc8","v2.6.38-rc2","v2.6.38-rc6","v2.6.38-rc5","v2.6.38-rc4","v2.6.38-rc3","v2.6.37-rc4","v2.6.37-rc2","v2.6.36","v2.6.37-rc5","v2.6.37-rc8","v2.6.37-rc7","v2.6.37-rc6","v2.6.37-rc1","v2.6.37-rc3","v2.6.36-rc6","v2.6.35-rc4","v2.6.36-rc8","v2.6.35","v2.6.36-rc7","v2.6.36-rc3","v2.6.36-rc5","v2.6.36-rc4","v2.6.36-rc2","v2.6.36-rc1","v2.6.35-rc5","v2.6.35-rc6","v2.6.34","v2.6.35-rc3","v2.6.35-rc1","v2.6.35-rc2","v2.6.34-rc7","v2.6.34-rc6","v2.6.34-rc5","v2.6.34-rc4","v2.6.34-rc3","v2.6.34-rc2","v2.6.34-rc1","v2.6.33","v2.6.33-rc6","v2.6.33-rc8","v2.6.33-rc4","v2.6.33-rc5","v2.6.33-rc3","v2.6.33-rc7","v2.6.33-rc2","v2.6.32","v2.6.33-rc1","v2.6.32-rc8","v2.6.32-rc7","v2.6.32-rc6","v2.6.31","v2.6.32-rc5","v2.6.32-rc4","v2.6.32-rc2","v2.6.32-rc1","v2.6.32-rc3","v2.6.31-rc9","v2.6.31-rc1","v2.6.31-rc7","v2.6.31-rc8","v2.6.31-rc6","v2.6.30-rc6","v2.6.30","v2.6.31-rc4","v2.6.31-rc5","v2.6.31-rc3","v2.6.31-rc2","v2.6.30-rc7","v2.6.30-rc8","v2.6.30-rc5","v2.6.30-rc3","v2.6.30-rc4","v2.6.30-rc1","v2.6.30-rc2","v2.6.29","v2.6.29-rc8","v2.6.29-rc7","v2.6.29-rc5","v2.6.29-rc1","v2.6.29-rc6","v2.6.29-rc4","v2.6.29-rc3","v2.6.29-rc2","v2.6.28","v2.6.28-rc7","v2.6.28-rc9","v2.6.28-rc8","v2.6.28-rc6","v2.6.28-rc5","v2.6.28-rc4","v2.6.28-rc2","v2.6.28-rc3","v2.6.28-rc1","v2.6.27","v2.6.27-rc7","v2.6.27-rc9","v2.6.27-rc8","v2.6.27-rc5","v2.6.27-rc6","v2.6.27-rc4","v2.6.27-rc1","v2.6.27-rc3","v2.6.27-rc2","v2.6.26","v2.6.26-rc9","v2.6.26-rc8","v2.6.26-rc3","v2.6.26-rc7","v2.6.26-rc6","v2.6.26-rc5","v2.6.26-rc4","v2.6.26-rc2","v2.6.26-rc1","v2.6.25","v2.6.25-rc7","v2.6.25-rc9","v2.6.25-rc8","v2.6.25-rc6","v2.6.25-rc5","v2.6.25-rc3","v2.6.25-rc4","v2.6.24","v2.6.25-rc2","v2.6.25-rc1","v2.6.24-rc8","v2.6.24-rc7","v2.6.24-rc6","v2.6.24-rc5","v2.6.24-rc4","v2.6.24-rc3","v2.6.24-rc2","v2.6.24-rc1","v2.6.23","v2.6.23-rc9","v2.6.23-rc8","v2.6.23-rc5","v2.6.23-rc7","v2.6.23-rc6","v2.6.23-rc4","v2.6.23-rc3","v2.6.23-rc2","v2.6.23-rc1","v2.6.22","v2.6.22-rc7","v2.6.22-rc6","v2.6.22-rc5","v2.6.22-rc4","v2.6.22-rc3","v2.6.22-rc2","v2.6.22-rc1","v2.6.21","v2.6.21-rc7","v2.6.21-rc6","v2.6.21-rc5","v2.6.21-rc4","v2.6.21-rc3","v2.6.21-rc2","v2.6.21-rc1","v2.6.20-rc7","v2.6.20-rc6","v2.6.20-rc5","v2.6.20-rc4","v2.6.20-rc3","v2.6.20-rc1","v2.6.20-rc2","v2.6.19-rc2","v2.6.18","v2.6.19-rc1","v2.6.18-rc6","v2.6.18-rc5","v2.6.18-rc3","v2.6.18-rc2","v2.6.18-rc1","v2.6.17","v2.6.17-rc4","v2.6.17-rc6","v2.6.17-rc5","v2.6.17-rc3","v2.6.17-rc2","v2.6.17-rc1","v2.6.16","v2.6.16-rc6","v2.6.16-rc4","v2.6.16-rc5","v2.6.16-rc3","v2.6.16-rc2","v2.6.16-rc1","v2.6.15-rc7","v2.6.15-rc5","v2.6.15-rc4","v2.6.15-rc2","v2.6.15-rc1","v2.6.14-rc3","v2.6.14-rc2","v2.6.14-rc1","v2.6.13","v2.6.13-rc7","v2.6.13-rc6","v2.6.13-rc5","v2.6.13-rc3","v2.6.13-rc4","v2.6.13-rc2","v2.6.13-rc1","v2.6.12-rc4","v2.6.12-rc3","v2.6.12-rc2"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49892.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"5.10.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.78"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.0.8"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49892.json"}}],"schema_version":"1.7.5"}