]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
tracing: Delay module ref count for "enable_event" trigger
authorSteven Rostedt <rostedt@goodmis.org>
Fri, 24 Jul 2026 17:24:15 +0000 (13:24 -0400)
committerSteven Rostedt <rostedt@goodmis.org>
Fri, 24 Jul 2026 22:49:51 +0000 (18:49 -0400)
commite091351b38818ef620d27f44f4bfd625f13afbff
tree0855b12d43d2869674bc7ecbf08864998dcda7df
parent79097812153b826fc156a2930ec8a90ed9edf4a2
tracing: Delay module ref count for "enable_event" trigger

Triggers are now delayed from freeing, but can still be triggered until
after the RCU grace period has ended. The freeing of the enable_event data
is put into the private_data_free() callback, but the put of the module
refcount is done immediately.

It is possible that if a module is removed that has an event that would
enable (or disable) it is still active, it can read the data of the module
after it is removed causing a use-after-free bug.

Move the trace_event_put_ref() that releases the module into the delayed
callback so that the module can not be removed until any reference to its
events are finished.

Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
kernel/trace/trace_events_trigger.c