[PATCH] tracing: Delay module ref count for "enable_event" trigger

[PATCH] tracing: Delay module ref count for "enable_event" trigger

[Steven Rostedt]

From: Steven Rostedt <rostedt@goodmis.org>

Triggers are now delayed from freeing, but can still be triggered until
after the RCU grace period has ended. The freeing of the enable_event data
is put into the private_data_free() callback, but the put of the module
refcount is done immediately.

It is possible that if a module is removed that has an event that would
enable (or disable) it is still active, it can read the data of the module
after it is removed causing a use-after-free bug.

Move the trace_event_put_ref() that releases the module into the delayed
callback so that the module can not be removed until any reference to its
events are finished.

Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/trace_events_trigger.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 46e60b70a4bb..ad83419cb420 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m,
 
 static void enable_trigger_private_data_free(struct event_trigger_data *data)
 {
-	kfree(data->private_data);
+	struct enable_trigger_data *enable_data = data->private_data;
+
+	trace_event_put_ref(enable_data->file->event_call);
+	kfree(enable_data);
 }
 
 void event_enable_trigger_free(struct event_trigger_data *data)
@@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_data *data)
 		/* Remove the SOFT_MODE flag */
 		trace_event_enable_disable(enable_data->file, 0, 1);
 		data->private_data_free = enable_trigger_private_data_free;
-		trace_event_put_ref(enable_data->file->event_call);
 		trigger_data_free(data);
 	}
 }
-- 
2.53.0

Re: [PATCH] tracing: Delay module ref count for "enable_event" trigger

[Alexander Gordeev]

On Fri, Jul 24, 2026 at 01:24:15PM -0400, Steven Rostedt wrote:

Hi Steven!

> From: Steven Rostedt <rostedt@goodmis.org>
> 
> Triggers are now delayed from freeing, but can still be triggered until
> after the RCU grace period has ended. The freeing of the enable_event data
> is put into the private_data_free() callback, but the put of the module
> refcount is done immediately.
> 
> It is possible that if a module is removed that has an event that would
> enable (or disable) it is still active, it can read the data of the module
> after it is removed causing a use-after-free bug.
> 
> Move the trace_event_put_ref() that releases the module into the delayed
> callback so that the module can not be removed until any reference to its
> events are finished.
> 
> Cc: stable@vger.kernel.org
> Reported-by: sashiko-bot@kernel.org
> Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> ---
>  kernel/trace/trace_events_trigger.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
> index 46e60b70a4bb..ad83419cb420 100644
> --- a/kernel/trace/trace_events_trigger.c
> +++ b/kernel/trace/trace_events_trigger.c
> @@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m,
>  
>  static void enable_trigger_private_data_free(struct event_trigger_data *data)
>  {
> -	kfree(data->private_data);
> +	struct enable_trigger_data *enable_data = data->private_data;
> +
> +	trace_event_put_ref(enable_data->file->event_call);
> +	kfree(enable_data);
>  }
>  
>  void event_enable_trigger_free(struct event_trigger_data *data)
> @@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_data *data)
>  		/* Remove the SOFT_MODE flag */
>  		trace_event_enable_disable(enable_data->file, 0, 1);
>  		data->private_data_free = enable_trigger_private_data_free;
> -		trace_event_put_ref(enable_data->file->event_call);
>  		trigger_data_free(data);
>  	}
>  }

This patch increasingly looks as a regression on s390.
We are hitting this once in a while when running the ftrace selftests:

    [ 1201.491469] ftrace: citest-start trigger-eventonoff.tc
    [ 1203.807215] Unable to handle kernel pointer dereference in virtual kernel address space
    [ 1203.807239] Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI
    [ 1203.807249] Fault in home space mode while using kernel ASCE.
    [ 1203.807259] AS:0000000031a20007 R3:0000000000000024 
    [ 1203.807292] Oops: 0038 ilc:2 [#1]SMP 
    [ 1203.807299] Modules linked in: algif_hash af_alg nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables dm_service_time zfcp scsi_transport_fc vfio_ccw s390_trng mdev vfio_iommu_type1 vfio sch_fq_codel drm i2c_core drm_panel_orientation_quirks dm_multipath vsock_loopback vmw_vsock_virtio_transport_common vsock diag288_wdt watchdog prng aes_s390 pkey_ep11 pkey_cca zcrypt paes_s390 phmac_s390 rng_core pkey_pckmo scsi_dh_alua scsi_dh_rdac scsi_dh_emc pkey crypto_engine autofs4 ecdsa_generic ecc sha512 [last unloaded: trace_printk]
    [ 1203.807361] CPU: 5 UID: 0 PID: 55241 Comm: trigger_data_fr Not tainted 7.2.0-20260731.rc5.300.fc44.s390x+debug #1 PREEMPT 
    [ 1203.807371] Hardware name: IBM 8561 T01 701 (z/VM 7.4.0)
    [ 1203.807373] Krnl PSW : 0704e00180000000 0000033302ba172a (trigger_kthread_fn+0x10a/0x160)
    [ 1203.807396]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
    [ 1203.807405] Krnl GPRS: 0000000000000000 0000033302ba1520 6b6b6b6b6b6b6b6b 0000022a16ae6b48
    [ 1203.807410]            0000000000000240 0000000000000240 0000022889f18100 0000000000000000
    [ 1203.807413]            0000022889f18100 000002297a5a3810 ffffffffffffff98 00000229b3f60080
    [ 1203.807416]            0000022889f18100 0000000000000000 0000000000000000 000002b304693d98
    [ 1203.807425] Krnl Code: 0000033302ba1718: e390b0280004	lg	%r9,40(%r11)
                              0000033302ba171e: e33090000004	lg	%r3,0(%r9)
                             *0000033302ba1724: e32030100004	lg	%r2,16(%r3)
                             >0000033302ba172a: 9110205b		tm	91(%r2),16
                              0000033302ba172e: a774ffd2		brc	7,0000033302ba16d2
                              0000033302ba1732: e32020480004	lg	%r2,72(%r2)
                              0000033302ba1738: c0e5fff8c234	brasl	%r14,0000033302ab9ba0
                              0000033302ba173e: a7f4ffcd		brc	15,0000033302ba16d8
    [ 1203.807446] Call Trace:
    [ 1203.807448]  [<0000033302ba172a>] trigger_kthread_fn+0x10a/0x160 
    [ 1203.807456] ([<0000033302ba16c8>] trigger_kthread_fn+0xa8/0x160)
    [ 1203.807464]  [<00000333029f1494>] kthread+0x164/0x190 
    [ 1203.807471]  [<000003330295c7bc>] __ret_from_fork+0x4c/0x340 
    [ 1203.807477]  [<0000033303af492a>] ret_from_fork+0xa/0x30 
    [ 1203.807482] INFO: lockdep is turned off.
    [ 1203.807484] Last Breaking-Event-Address:
    [ 1203.807486]  [<0000033302ba16c8>] trigger_kthread_fn+0xa8/0x160

I did not manage to come up with a reproducer - if you have any idea,
please let me know.

Thanks!