perf_ftrace_function_unregister() unconditionally calls
unregister_ftrace_function() without checking whether the ftrace_ops
was ever successfully registered. This triggers a WARN_ON in
__unregister_ftrace_function() when the ops doesn't have
FTRACE_OPS_FL_ENABLED set.

This can happen during perf_event_alloc() error cleanup when
perf_trace_destroy() is called via __free_event() on an event whose
ftrace_ops registration failed or was already torn down by
perf_try_init_event()'s err_destroy path.

The call path is:
  perf_event_alloc() error cleanup
    -> __free_event()
      -> event->destroy() [tp_perf_event_destroy]
        -> perf_trace_destroy()
          -> perf_trace_event_close()
            -> TRACE_REG_PERF_CLOSE
              -> perf_ftrace_function_unregister()
                -> unregister_ftrace_function()
                  -> __unregister_ftrace_function()
                    -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))

Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to
unregister. If the ops is not enabled, just free the filter and
return success.

Signed-off-by: Rik van Riel <riel@surriel.com>
---
 kernel/trace/trace_event_perf.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index a6bb7577e8c5..5b272856e5ab 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -497,7 +497,17 @@ static int perf_ftrace_function_register(struct perf_event *event)
 static int perf_ftrace_function_unregister(struct perf_event *event)
 {
 	struct ftrace_ops *ops = &event->ftrace_ops;
-	int ret = unregister_ftrace_function(ops);
+	int ret = 0;
+
+	/*
+	 * Perf will call this unconditionally even if the ops is not
+	 * enabled. The unregister_ftrace_function() will warn if called
+	 * when not enabled. Just bypass the unregistering if ops isn't
+	 * enabled here.
+	 */
+	if (ops->flags & FTRACE_OPS_FL_ENABLED)
+		ret = unregister_ftrace_function(ops);
+
 	ftrace_free_filter(ops);
 	return ret;
 }
-- 
2.54.0

On Wed, 27 May 2026 11:13:01 -0400
Rik van Riel <riel@surriel.com> wrote:

> perf_ftrace_function_unregister() unconditionally calls
> unregister_ftrace_function() without checking whether the ftrace_ops
> was ever successfully registered. This triggers a WARN_ON in
> __unregister_ftrace_function() when the ops doesn't have
> FTRACE_OPS_FL_ENABLED set.
> 
> This can happen during perf_event_alloc() error cleanup when
> perf_trace_destroy() is called via __free_event() on an event whose
> ftrace_ops registration failed or was already torn down by
> perf_try_init_event()'s err_destroy path.
> 
> The call path is:
>   perf_event_alloc() error cleanup
>     -> __free_event()
>       -> event->destroy() [tp_perf_event_destroy]
>         -> perf_trace_destroy()
>           -> perf_trace_event_close()
>             -> TRACE_REG_PERF_CLOSE
>               -> perf_ftrace_function_unregister()
>                 -> unregister_ftrace_function()
>                   -> __unregister_ftrace_function()
>                     -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))  
> 
> Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to
> unregister. If the ops is not enabled, just free the filter and
> return success.
> 
> Signed-off-by: Rik van Riel <riel@surriel.com>

Thanks Rik. Is this urgent where it should have a Fixes tag and Cc
stable as well as be sent to Linus during the -rc release, or can it
wait for the next merge window?

-- Steve

On Wed, 2026-05-27 at 11:37 -0400, Steven Rostedt wrote:
> On Wed, 27 May 2026 11:13:01 -0400
> Rik van Riel <riel@surriel.com> wrote:
> 
> > perf_ftrace_function_unregister() unconditionally calls
> > unregister_ftrace_function() without checking whether the
> > ftrace_ops
> > was ever successfully registered. This triggers a WARN_ON in
> > __unregister_ftrace_function() when the ops doesn't have
> > FTRACE_OPS_FL_ENABLED set.
> > 
> > This can happen during perf_event_alloc() error cleanup when
> > perf_trace_destroy() is called via __free_event() on an event whose
> > ftrace_ops registration failed or was already torn down by
> > perf_try_init_event()'s err_destroy path.
> > 
> > The call path is:
> >   perf_event_alloc() error cleanup
> >     -> __free_event()
> >       -> event->destroy() [tp_perf_event_destroy]
> >         -> perf_trace_destroy()
> >           -> perf_trace_event_close()
> >             -> TRACE_REG_PERF_CLOSE
> >               -> perf_ftrace_function_unregister()
> >                 -> unregister_ftrace_function()
> >                   -> __unregister_ftrace_function()
> >                     -> WARN_ON(!(ops->flags &
> > FTRACE_OPS_FL_ENABLED))  
> > 
> > Fix this by checking FTRACE_OPS_FL_ENABLED before attempting to
> > unregister. If the ops is not enabled, just free the filter and
> > return success.
> > 
> > Signed-off-by: Rik van Riel <riel@surriel.com>
> 
> Thanks Rik. Is this urgent where it should have a Fixes tag and Cc
> stable as well as be sent to Linus during the -rc release, or can it
> wait for the next merge window?
> 

I don't think this patch has any particular urgency.

It can go in using whatever flow is most convenient.

-- 
All Rights Reversed.