Re: [PATCH] tracing: Take trace_array reference when opening options file

[Steven Rostedt <rostedt@goodmis.org>]

On Tue, 1 Sep 2026 19:13:39 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> > For example, if a user opens a per-instance tracing_max_latency file,
> > keeps the descriptor open, and the instance is removed, could a
> > subsequent write dereference the freed memory?

Not sure what tree you are looking at.

> > 
> > kernel/trace/trace.c:tracing_max_lat_write() {

That function has been moved to trace_snapshot.c

> >     ...
> >     return tracing_nsecs_write(filp->private_data, ubuf, cnt, ppos);
> > }
> > 
> > Where tracing_nsecs_write would perform an unlocked write to the
> > freed pointer?  

and this has been fixed by:

  7d660c9b2bc95 ("tracing: Have tracing_max_latency inc the trace array ref count")

That was added in 2023.

-- Steve