[PATCH v5] tracing: Fix race between update_event_fields and, event_define_fields

[PATCH v5] tracing: Fix race between update_event_fields and, event_define_fields

[Michael Wu]

The following sequence may leads race between event_define_fields()
and update_event_fields():
  CPU0 (module A, pri=1 notifier)        CPU1 (module B, pri=0 notifier)
  ===============================        ===============================
  event_define_fields(call_A)            trace_event_update_all()
    for each f:                            list_for_each_entry(...,
      list_add(&f->link,                                &ftrace_events)
               &class->fields)               -> finds call_A
        f->link.next = next;        (2)
                                           update_event_fields(call_A)
        WRITE_ONCE(class->fields->next,
                   &f->link);       (4)
                                             list_for_each_entry(field,
                                               &class->fields, link)
                                             -> field = class->fields->next
                                                  = &f->link
                                                  = f (offset 0)
                                             -> arm64 weak ordering:
                                                (4) visible before (2)
                                                field->link.next == 0
                                             -> next iteration:
                                                field = (void *)0 = NULL
                                             -> crash at NULL->type (0x18)

This produces the following panic:
   Unable to handle kernel access ... at virtual address 0000000000000018
   pc : update_event_fields+0xf8/0x368
   Call trace:
    update_event_fields+0xf8/0x368
    trace_event_update_all+0x7c/0x2b4
    trace_module_notify+0x4c/0x1dc
    notifier_call_chain+0x84/0x168
    blocking_notifier_call_chain_robust+0x64/0xd4
    load_module+0x10c8/0x123c
    __arm64_sys_finit_module+0x230/0x31c

Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.

Fixes: b3bc8547d3be ("tracing: Have TRACE_DEFINE_ENUM affect trace event types as well")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Wu <michael@allwinnertech.com>
---
 kernel/trace/trace_events.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 956692856fa8..9632788da5af 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3566,6 +3566,7 @@ void trace_event_update_all(struct trace_eval_map **map, int len)
 	int last_i;
 	int i;
 
+	mutex_lock(&event_mutex);
 	down_write(&trace_event_sem);
 	list_for_each_entry_safe(call, p, &ftrace_events, list) {
 		/* events are usually grouped together with systems */
@@ -3604,6 +3605,7 @@ void trace_event_update_all(struct trace_eval_map **map, int len)
 		cond_resched();
 	}
 	up_write(&trace_event_sem);
+	mutex_unlock(&event_mutex);
 }
 
 static bool event_in_systems(struct trace_event_call *call,
-- 
2.29.0

Re: [PATCH v5] tracing: Fix race between update_event_fields and, event_define_fields

[Steven Rostedt]

On Mon, 10 Aug 2026 14:32:30 +0800
Michael Wu <michael@allwinnertech.com> wrote:

> The following sequence may leads race between event_define_fields()
> and update_event_fields():

>   CPU0 (module A, pri=1 notifier)        CPU1 (module B, pri=0 notifier)

What does the above mean? Are you loading two modules at the same time?
What does "pri=X notifier" mean? What function calls are these coming from?

-- Steve

>   ===============================        ===============================
>   event_define_fields(call_A)            trace_event_update_all()
>     for each f:                            list_for_each_entry(...,
>       list_add(&f->link,                                &ftrace_events)
>                &class->fields)               -> finds call_A
>         f->link.next = next;        (2)
>                                            update_event_fields(call_A)
>         WRITE_ONCE(class->fields->next,
>                    &f->link);       (4)
>                                              list_for_each_entry(field,
>                                                &class->fields, link)
>                                              -> field = class->fields->next  
>                                                   = &f->link
>                                                   = f (offset 0)
>                                              -> arm64 weak ordering:  
>                                                 (4) visible before (2)
>                                                 field->link.next == 0
>                                              -> next iteration:  
>                                                 field = (void *)0 = NULL
>                                              -> crash at NULL->type (0x18)  
> 
> This produces the following panic:
>    Unable to handle kernel access ... at virtual address 0000000000000018
>    pc : update_event_fields+0xf8/0x368
>    Call trace:
>     update_event_fields+0xf8/0x368
>     trace_event_update_all+0x7c/0x2b4
>     trace_module_notify+0x4c/0x1dc
>     notifier_call_chain+0x84/0x168
>     blocking_notifier_call_chain_robust+0x64/0xd4
>     load_module+0x10c8/0x123c
>     __arm64_sys_finit_module+0x230/0x31c
> 
> Fix by taking event_mutex in trace_event_update_all() before
> trace_event_sem.
> 
> Fixes: b3bc8547d3be ("tracing: Have TRACE_DEFINE_ENUM affect trace event types as well")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michael Wu <michael@allwinnertech.com>