On Fri, Jul 24, 2026 at 01:24:15PM -0400, Steven Rostedt wrote: Hi Steven!
> From: Steven Rostedt <[email protected]> > > Triggers are now delayed from freeing, but can still be triggered until > after the RCU grace period has ended. The freeing of the enable_event data > is put into the private_data_free() callback, but the put of the module > refcount is done immediately. > > It is possible that if a module is removed that has an event that would > enable (or disable) it is still active, it can read the data of the module > after it is removed causing a use-after-free bug. > > Move the trace_event_put_ref() that releases the module into the delayed > callback so that the module can not be removed until any reference to its > events are finished. > > Cc: [email protected] > Reported-by: [email protected] > Link: > https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com > Signed-off-by: Steven Rostedt <[email protected]> > --- > kernel/trace/trace_events_trigger.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/kernel/trace/trace_events_trigger.c > b/kernel/trace/trace_events_trigger.c > index 46e60b70a4bb..ad83419cb420 100644 > --- a/kernel/trace/trace_events_trigger.c > +++ b/kernel/trace/trace_events_trigger.c > @@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m, > > static void enable_trigger_private_data_free(struct event_trigger_data *data) > { > - kfree(data->private_data); > + struct enable_trigger_data *enable_data = data->private_data; > + > + trace_event_put_ref(enable_data->file->event_call); > + kfree(enable_data); > } > > void event_enable_trigger_free(struct event_trigger_data *data) > @@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct > event_trigger_data *data) > /* Remove the SOFT_MODE flag */ > trace_event_enable_disable(enable_data->file, 0, 1); > data->private_data_free = enable_trigger_private_data_free; > - trace_event_put_ref(enable_data->file->event_call); > trigger_data_free(data); > } > } This patch increasingly looks as a regression on s390. We are hitting this once in a while when running the ftrace selftests: [ 1201.491469] ftrace: citest-start trigger-eventonoff.tc [ 1203.807215] Unable to handle kernel pointer dereference in virtual kernel address space [ 1203.807239] Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI [ 1203.807249] Fault in home space mode while using kernel ASCE. [ 1203.807259] AS:0000000031a20007 R3:0000000000000024 [ 1203.807292] Oops: 0038 ilc:2 [#1]SMP [ 1203.807299] Modules linked in: algif_hash af_alg nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables dm_service_time zfcp scsi_transport_fc vfio_ccw s390_trng mdev vfio_iommu_type1 vfio sch_fq_codel drm i2c_core drm_panel_orientation_quirks dm_multipath vsock_loopback vmw_vsock_virtio_transport_common vsock diag288_wdt watchdog prng aes_s390 pkey_ep11 pkey_cca zcrypt paes_s390 phmac_s390 rng_core pkey_pckmo scsi_dh_alua scsi_dh_rdac scsi_dh_emc pkey crypto_engine autofs4 ecdsa_generic ecc sha512 [last unloaded: trace_printk] [ 1203.807361] CPU: 5 UID: 0 PID: 55241 Comm: trigger_data_fr Not tainted 7.2.0-20260731.rc5.300.fc44.s390x+debug #1 PREEMPT [ 1203.807371] Hardware name: IBM 8561 T01 701 (z/VM 7.4.0) [ 1203.807373] Krnl PSW : 0704e00180000000 0000033302ba172a (trigger_kthread_fn+0x10a/0x160) [ 1203.807396] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 [ 1203.807405] Krnl GPRS: 0000000000000000 0000033302ba1520 6b6b6b6b6b6b6b6b 0000022a16ae6b48 [ 1203.807410] 0000000000000240 0000000000000240 0000022889f18100 0000000000000000 [ 1203.807413] 0000022889f18100 000002297a5a3810 ffffffffffffff98 00000229b3f60080 [ 1203.807416] 0000022889f18100 0000000000000000 0000000000000000 000002b304693d98 [ 1203.807425] Krnl Code: 0000033302ba1718: e390b0280004 lg %r9,40(%r11) 0000033302ba171e: e33090000004 lg %r3,0(%r9) *0000033302ba1724: e32030100004 lg %r2,16(%r3) >0000033302ba172a: 9110205b tm 91(%r2),16 0000033302ba172e: a774ffd2 brc 7,0000033302ba16d2 0000033302ba1732: e32020480004 lg %r2,72(%r2) 0000033302ba1738: c0e5fff8c234 brasl %r14,0000033302ab9ba0 0000033302ba173e: a7f4ffcd brc 15,0000033302ba16d8 [ 1203.807446] Call Trace: [ 1203.807448] [<0000033302ba172a>] trigger_kthread_fn+0x10a/0x160 [ 1203.807456] ([<0000033302ba16c8>] trigger_kthread_fn+0xa8/0x160) [ 1203.807464] [<00000333029f1494>] kthread+0x164/0x190 [ 1203.807471] [<000003330295c7bc>] __ret_from_fork+0x4c/0x340 [ 1203.807477] [<0000033303af492a>] ret_from_fork+0xa/0x30 [ 1203.807482] INFO: lockdep is turned off. [ 1203.807484] Last Breaking-Event-Address: [ 1203.807486] [<0000033302ba16c8>] trigger_kthread_fn+0xa8/0x160 I did not manage to come up with a reproducer - if you have any idea, please let me know. Thanks!
