Linux Kernel Tracing Vulnerability in Process String Handling

A vulnerability in the Linux kernel's tracing subsystem has been addressed. The issue arose in the process_string() function, which processes strings for TRACE_EVENT() TP_fast_assign() macros. These macros could inadvertently assign a pointer to a dynamically allocated string to the ring buffer, and later reference it in TP_printk() format, potentially leading to the use of a freed string. To mitigate this, the test_event_printk() function was introduced to verify that string references in TP_printk() are safe, but it may produce false positives. For example, the xe_bo_move() event was incorrectly flagged because it referenced an array of pointers that should have been considered safe.

Impact

The vulnerability could lead to use-after-free errors by allowing dereferencing of freed strings, which could potentially be exploited to execute arbitrary code.