CVE: CVE-2022-49977
Published: 2025-06-18
Description: In the Linux kernel, the following vulnerability has been resolved:

ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

ftrace_startup does not remove ops from ftrace_ops_list when
ftrace_startup_enable fails:

register_ftrace_function
  ftrace_startup
    __register_ftrace_function
      ...
      add_ftrace_ops(&ftrace_ops_list, ops)
      ...
    ...
    ftrace_startup_enable // if ftrace failed to modify, ftrace_disabled is set to 1
    ...
  return 0 // ops is in the ftrace_ops_list.

When ftrace_disabled = 1, unregister_ftrace_function simply returns without doing anything:
unregister_ftrace_function
  ftrace_shutdown
    if (unlikely(ftrace_disabled))
            return -ENODEV;  // return here, __unregister_ftrace_function is not executed,
                             // as a result, ops is still in the ftrace_ops_list
    __unregister_ftrace_function
    ...

If ops is dynamically allocated, it will be free later, in this case,
is_ftrace_trampoline accesses NULL pointer:

is_ftrace_trampoline
  ftrace_ops_trampoline
    do_for_each_ftrace_op(op, ftrace_ops_list) // OOPS! op may be NULL!

Syzkaller reports as follows:
[ 1203.506103] BUG: kernel NULL pointer dereference, address:[PII_REDACTED]00010b
[ 1203.508039] #PF: supervisor read access in kernel mode
[ 1203.508798] #PF: error_code(0x0000) - not-present page
[ 1203.509558] PGD[PII_REDACTED]60b067 P4D[PII_REDACTED]60b067 PUD 130fb8067 PMD 0
[ 1203.510560] Oops: 0000 [#1] SMP KASAN PTI
[ 1203.511189] CPU: 6 PID: 29532 Comm: syz-executor.2 Tainted: G    B   W         5.10.0 #8
[ 1203.512324] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 1203.513895] RIP: 0010:is_ftrace_trampoline+0x26/0xb0
[ 1203.514644] Code: ff eb d3 90 41 55 41 54 49 89 fc 55 53 e8 f2 00 fd ff 48 8b 1d 3b 35 5d 03 e8 e6 00 fd ff 48 8d bb 90 00 00 00 e8 2a 81 26 00 <48> 8b ab 90 00 00 00 48 85 ed 74 1d e8 c9 00 fd ff 48 8d bb 98 00
[ 1203.518838] RSP: 0018:ffffc900012cf960 EFLAGS: 00010246
[ 1203.520092] RAX: [PII_REDACTED] RBX:[PII_REDACTED]00007b RCX: ffffffff8a331866
[ 1203.521469] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI:[PII_REDACTED]00010b
[ 1203.522583] RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: ffffffff8df18b07
[ 1203.523550] R10: fffffbfff1be3160 R11: [PII_REDACTED] R12: [PII_REDACTED]
[ 1203.524596] R13: [PII_REDACTED] R14: ffff[PII_REDACTED]00 R15: [PII_REDACTED]
[ 1203.525634] FS:  00007f429f5f4700(0000) GS:ffff8881daf00000(0000) knlGS:[PII_REDACTED]
[ 1203.526801] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[ 1203.527626] CR2:[PII_REDACTED]00010b CR3:[PII_REDACTED]e1e001 CR4:[PII_REDACTED]3706e0
[ 1203.528611] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
[ 1203.529605] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]

Therefore, when ftrace_startup_enable fails, we need to rollback registration
process and remove ops from ftrace_ops_list.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/4c34a2a6c9927c239dd2e295a03d49b37b618d2c; https://git.kernel.org/stable/c/8569b4ada1e0b9bfaa125bd0c0967918b6560fa2; https://git.kernel.org/stable/c/934e49f7d696afdae9f979abe3f308408184e17b