From: Steven Rostedt Date: Fri, 24 Jul 2026 17:24:15 +0000 (-0400) Subject: tracing: Delay module ref count for "enable_event" trigger X-Git-Tag: v7.2-rc5~8^2~2 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=e091351b38818ef620d27f44f4bfd625f13afbff;p=thirdparty%2Fkernel%2Flinux.git tracing: Delay module ref count for "enable_event" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enable_event data is put into the private_data_free() callback, but the put of the module refcount is done immediately. It is possible that if a module is removed that has an event that would enable (or disable) it is still active, it can read the data of the module after it is removed causing a use-after-free bug. Move the trace_event_put_ref() that releases the module into the delayed callback so that the module can not be removed until any reference to its events are finished. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") Signed-off-by: Steven Rostedt --- diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c index 46e60b70a4bb..ad83419cb420 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m, static void enable_trigger_private_data_free(struct event_trigger_data *data) { - kfree(data->private_data); + struct enable_trigger_data *enable_data = data->private_data; + + trace_event_put_ref(enable_data->file->event_call); + kfree(enable_data); } void event_enable_trigger_free(struct event_trigger_data *data) @@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_data *data) /* Remove the SOFT_MODE flag */ trace_event_enable_disable(enable_data->file, 0, 1); data->private_data_free = enable_trigger_private_data_free; - trace_event_put_ref(enable_data->file->event_call); trigger_data_free(data); } }