From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B25B3CF04C; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; cv=none; b=N5sOOX0Uiil7zaVsNKR+tfd6B6KdzE1aXNCIWtcEbTCMlFNXHlkUxPMAmGWFp+/K0KedUyQM62LhGrlXL7t7gsW9BpA66l1PvrZmrTzS7myPFl29Dw74czgXoBCUyvjw6L2wpqvYDyMPheKnkRECAGUODx20aiOypFuS1oEMbWI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; c=relaxed/simple; bh=uFJSMA3qYpVAa+oE3Lj/zsz7CTGbfvJkRkMRMP4ZcFQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Gd8J+OVt0RlmN+MWWFFpbq5sGZ3pBBD3OJSR7EXO87KXJEetFKRxNrbTqc8Vr2JXbFbsPx6wzD/qgDOPDJiAsJpqxLMpNYhvay9fVQyLI5/3kgbcymY9xg9ocg1gsDXFlyJYn4HZXS1rk1XR87zT0DU27dOM06yOWCcTXEbygAU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=epxZKD7f; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="epxZKD7f" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D84661F00A3A; Fri, 24 Jul 2026 23:18:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935109; bh=1zOLheDNrEZSKVgM7iDuqJEupl58RtK41Jq8kQb0uG0=; h=Date:From:To:Cc:Subject:References; b=epxZKD7fmDPNf9UHAvHoVCeg7LtocVOqHH4r8eN9E4IvE0VbxeoE10avIVCRdVsht M/AMuT/4JyCUnqInICV2ZK2qcGTCgw/IYlOMFyo/dO11bMxoRi2X1a6097tJd4H/s8 gSLWTr7nWQO8u8ofrcHiMrZNezbcWjmWKulRTxoKYExYbwZ+xtFzp7LGXyJ+sulbVL d6YNSG1eoFHhP8q/8wDki0t0j28MePJX/uHcgNULehecKNuQKmZY1ti02Dxe+X0ThV pIKXoSR+3czbZzcKUcYQtrObnwTJLTOCm7CgcGGntFsd+NLkbIQDBK733pZOCIDj5G vxB3g66NY3zfA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAN-000000046rW-36Kw; Fri, 24 Jul 2026 19:18:55 -0400 Message-ID: <20260724231855.591578614@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:41 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Fuad Tabba , Vincent Donnefort Subject: [for-linus][PATCH 1/9] tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Fuad Tabba page_va[] is annotated __counted_by(nr_page_va), so nr_page_va must cover an index before that element is accessed. The allocation loop writes page_va[id] while nr_page_va is still id and increments it only afterwards, so every write is one element past the declared count. The store is out of bounds with respect to the annotation: a build with CONFIG_UBSAN_BOUNDS on a toolchain that honours __counted_by (clang >=3D 20.1, gcc >=3D 15.1) flags it as an array-index overflow. Increment nr_page_va before writing the element it now covers. A failed allocation then leaves the slot counted but NULL; the error path frees it with free_page(0), which is a no-op. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260713072823.2668323-1-fuad.tabba@linux.dev Fixes: 96e43537af546 ("tracing: Introduce trace remotes") Signed-off-by: Fuad Tabba Reviewed-by: Vincent Donnefort Tested-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/trace_remote.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index 0f6ef5c36d84..ef42d9c38b37 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -1004,11 +1004,10 @@ int trace_remote_alloc_buffer(struct trace_buffer_d= esc *desc, size_t desc_size, desc->nr_cpus++; =20 for (id =3D 0; id < nr_pages; id++) { + rb_desc->nr_page_va++; rb_desc->page_va[id] =3D (unsigned long)__get_free_page(GFP_KERNEL); if (!rb_desc->page_va[id]) goto err; - - rb_desc->nr_page_va++; } rb_desc =3D __next_ring_buffer_desc(rb_desc); } --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48E1447427E; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; cv=none; b=YmP1HchaxQSk+RouvVPIBT+11031eBTRNdBO2ElTNLYHt3GoVOF8uW0VG/sYi5AtYCeGY6cELwL6RPd4ztjOUWJvs7AQx1cRNwY4Gd35IAQcZVLzWF8RBzZ9f+YK7vCT/+UJVR9WhbwzkCRDAnUR46styUz9NQ4SPuttOlhiY6I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; c=relaxed/simple; bh=F2tOvf5WD4E8NO3UV1aGiMKnBAAKeygyXub8ARPV0M4=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=HLIEUbdTkNqoPso7NiE5ZkkAZ+0l+RqOorKREZtHJHrPQAZNHlGyQJr2Q2f2NB4IQFG9r1yTpLAhAViLwT3iQuYWAaY81tP0kjesyzy+kuKNZrLXC+Aa54mPhN/TBt7a4FZksd1FDQfBJANelwLmzld5CjwPGxyEneWCrCth03k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YlFNjxl5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YlFNjxl5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B8D11F00A3F; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=5hSA46R/NCpekSUYTMDGIBZjpTxT9+AGiLZ4O7dJxk4=; h=Date:From:To:Cc:Subject:References; b=YlFNjxl5VeXzAP/RrpA/rexYXXLgf8P82FxUTOlPF1c3bNkvBR8Nj3EHoglPmXijj gm9+xnzhvr72vEp3Erq/IfBT7fTV/AdxeMY35KzzUpbNQtwvuxX2eV6UmQ3yvSTPxP JxYWRXf8wwlrpbyVCxmnxysZ4EwTJmPH4xI4Ef+YgH7f91WCkVR05KDCeDY4sqE60K 9+CpzLaeXyFrKe2atGIzddwPdOPp10FmV2MzE/olVRN84o2frwCKoTR0lEGsDpq4QK 7lRphaNBvtndxnXrBQqdYARCtqE19oVNSIBiG1ftEcHVUjArq0rkVTJUf6cM6DPY6X hNeo48Gi/XqQw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAN-000000046s0-3nVd; Fri, 24 Jul 2026 19:18:55 -0400 Message-ID: <20260724231855.758081600@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:42 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Jackie Liu , Vincent Donnefort Subject: [for-linus][PATCH 2/9] tracing: Propagate errors from remote event bulk updates References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jackie Liu remote_events_dir_enable_write() ignores the return value from trace_remote_enable_event(). If a remote rejects an event state change, the write therefore reports success even though the affected event remains in its previous state. Keep trying all events, but retain and return the first error. This matches __ftrace_set_clr_event_nolock(), which permits partial updates while notifying userspace when an operation fails. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260715074455.3897-1-liu.yun@linux.dev Fixes: 775cb093bc50 ("tracing: Add events/ root files to trace remotes") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Jackie Liu Reviewed-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/trace_remote.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index ef42d9c38b37..e6724f947170 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -1149,10 +1149,21 @@ static ssize_t remote_events_dir_enable_write(struc= t file *filp, const char __us =20 for (i =3D 0; i < remote->nr_events; i++) { struct remote_event *evt =3D &remote->events[i]; + int eret; =20 - trace_remote_enable_event(remote, evt, enable); + eret =3D trace_remote_enable_event(remote, evt, enable); + /* + * Save the first error and return that. Some events + * may still have been enabled, but let the user + * know that something went wrong. + */ + if (!ret && eret) + ret =3D eret; } =20 + if (ret) + return ret; + return count; } =20 --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48EC44749CE; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; cv=none; b=ZeBxNpnuVLGzumiaanDcatdini1IKhFxV6vMEW4/dd9/FB1PIaltaN5dCZ/d3H1JCNAu6oBbUuyi/+nvQ84wrlUFXhu6MGq96JypSLabSSN9Rr99imvN91CekwbrbIKLMszhMnNIAlH97i4X82n2AiiEXS1eMMCb035lDBbEWfE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; c=relaxed/simple; bh=hiZniiTI5V3U8iIvSaUz+PUtQvP0z5PC+u3kETLwZfQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=BsnHhzxwuw7YuOAJHbYbMNWWK83SN+J8c+HzILHOtNJkNsKGUE1FF2leUcc+C9telEcocmpt5Zul3946cCa4qsTVzaOobMU5yXLFMz91g1+2B+22RP9sdsKzEwiZpBM5BaA4+poF/q/LVGqxHj1RyQocT/Qf4dw2wv2Ss95p+cw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AZzD8+cG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AZzD8+cG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F4F11F00A3D; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=OEJYOBTIQEkX1Alk5aUjmgd0ffsn8eNnc8yZtywg2LA=; h=Date:From:To:Cc:Subject:References; b=AZzD8+cGIVVbR7otrsGxIcfkwncjfGa2C0Vue3G4HUZmnL9bgYwJzutPLe0DVorPd sqbHL4bE3PCkwdhwSn7dB6C0Bknopil22racBIxNMgXL3fwzc91ltsHIAfNd8aPFSO jNQ/JUgSL4TtIyQTzPnt66rPmRwJ0L0l015fr/u97qjD9wnjnBOkiSXF/6cwUW5IM3 TG2HzbPrd/mGAm5m3XiHfWaYn+c3AkqNVjSlOBtN4akaUC5ilEqvF8DMLmC2lm4DK8 xgFJNNBj0CZtHknr6KQMA/9IjzLQsRJi9RXWO42KxYC00Upq74ZChLL2YqQGIzE8Lv 8rzqeWDvlKa3g== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046sU-0JMd; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231855.925138691@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:43 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, deepakraog Subject: [for-linus][PATCH 3/9] tracing: Fix resource leak on mmiotrace trace_pipe close References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: deepakraog The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipe_open() could not be freed because there was not pipe_close function pointer of the tracer. The pipe_close function pointer was added in December 7th, 2009, but the mmiotrace tracer was not updated. mmio_pipe_open() allocates a header_iter and takes a pci_dev reference when trace_pipe is opened. mmio_close() frees them, but it was only wired to the tracer's .close callback. tracing_release_pipe() invokes .pipe_close, not .close, when the trace_pipe file is released. As a result, closing trace_pipe with the mmiotrace tracer active leaked the header_iter allocation and left a stale pci_dev reference. Set .pipe_close to mmio_close, matching how function_graph wires both callbacks to the same handler. Note, if the trace_pipe is read to completion, it will clean up the resources, but if one were to run: # head -n 1 /sys/kernel/tracing/trace_pipe VERSION 20070824 Over and over again, it would trigger a massive leak. Cc: stable@vger.kernel.org Fixes: c521efd1700a8 ("tracing: Add pipe_close interface) Link: https://patch.msgid.link/20260715143604.14481-1-gaikwad.dcg@gmail.com Signed-off-by: deepakraog Signed-off-by: Steven Rostedt --- kernel/trace/trace_mmiotrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c index 226cf66e0d68..20812e7f911f 100644 --- a/kernel/trace/trace_mmiotrace.c +++ b/kernel/trace/trace_mmiotrace.c @@ -109,7 +109,6 @@ static void mmio_pipe_open(struct trace_iterator *iter) iter->private =3D hiter; } =20 -/* XXX: This is not called when the pipe is closed! */ static void mmio_close(struct trace_iterator *iter) { struct header_iter *hiter =3D iter->private; @@ -279,6 +278,7 @@ static struct tracer mmio_tracer __read_mostly =3D .start =3D mmio_trace_start, .pipe_open =3D mmio_pipe_open, .close =3D mmio_close, + .pipe_close =3D mmio_close, .read =3D mmio_read, .print_line =3D mmio_print_line, .noboot =3D true, --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 73A4E4749FC; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; cv=none; b=SacgQbVAuxXvnse224KfQG7gjNitSblhk030lsAbkZYHmkJcWBGvWLqLhLQawBulHafSiF7p/SHoxGG7Tca882L/KY96/yHsc6toRC+3s2okaLCHxn2G5FjosBnanL/6GYyYgExU7ZOAtBfKNw7CPD4IuXGWPvEa2qENiMK2UIs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935111; c=relaxed/simple; bh=5vXE0PhSNG6DD41aTyCfzaKSlB/mB2jHbx/Ufjc5BNY=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=rIhDm5CW97qGva+futo1ePbVac2x/o6FUWiRN+N4J483DjmiE4jJa8kVYYHbrSocWlB0vrahaN/O6uADH7qMu+33kHpjiYKN7bdSI+BUpOW8NmpNHk7LC6YGOpJ6PWP0l/A+T6iKxK+1B91Y2sm7zcQL2m5GctsAEqCvXO8wO1Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=EVdIC0BA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="EVdIC0BA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 588801F00A3E; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=FhZ/5Pv9AeXrXf4KLh5hTBTtjmg9+0RNyc9HRq1oARg=; h=Date:From:To:Cc:Subject:References; b=EVdIC0BATVMJcZMc0OsA7IS2T6mvDAmoDitSiWrcgPOGpyM+rLXbJTc415z/K4FFU sdMGe7vWldFAY8OeXV6VJJtxcNauUK/PIdT766FKchcnD94I+vjRbG1oFwS/0xx0FS ZgkLZ5SB+6/Om9gSD7wSIQBCisNaeUnA4DLEShwNqidx4Z82t6EIBvBTeoQQ/AwN5x w6Ak1mBvnXCquoh55FpXlBNjgE2ggOaGOlxSdUrCDnM3DQjlFR5o0K7Vo0xJGSIih+ x9g+zq3r5gb7KW2vJb3HGFrBuYo5Nu9hkWoRq/D8h5+yWwXw6LPHPx7h5TBfMMlZg8 ZF0nlToBj82bw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046sy-0yEk; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231856.091344694@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:44 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Sashiko Subject: [for-linus][PATCH 4/9] tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt If the mmio_pipe_open() fails to find a PCI device, the hiter->dev will be assigned to NULL. The mmiotrace read() function dereferences the hiter->dev if hiter exists. Change the test of the read to not only check hiter being NULL, but also the hiter->dev before dereferencing it. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260721211143.36dbd559@gandalf.local.home Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin") Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260715143604.14481-1-gaikwad.dcg%40g= mail.com Signed-off-by: Steven Rostedt --- kernel/trace/trace_mmiotrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c index 20812e7f911f..b88b8d9923ad 100644 --- a/kernel/trace/trace_mmiotrace.c +++ b/kernel/trace/trace_mmiotrace.c @@ -145,7 +145,7 @@ static ssize_t mmio_read(struct trace_iterator *iter, s= truct file *filp, goto print_out; } =20 - if (!hiter) + if (!hiter || !hiter->dev) return 0; =20 mmio_print_pcidev(s, hiter->dev); --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4DB61449EB2; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; cv=none; b=d1VB5UsRPK7Z2mVffw45ll5rMaMYjZIidHmP6zrLMFd2WxR0xnc6lJ6SgtWYm/xTewteUhP0Mf2sMI8wSS8B3mJC6QYe5zxFdABtXeV0AdRhclXcYYTE3MwcTkxszZbFwZm6z+QJ6eb72tqbjsE7mhOhENDtmqXzYwV6dG5f/po= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; c=relaxed/simple; bh=EwOc+Z/ERUb+ga5bspF4l2UOMQNyOPNtuMixc2nPWhc=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=KDNwCPt18EYzE8ap+E6AsATtQMVIyJcKuHmmp4S2Des6GjS1mXIp79wcuRHIVkuUQH/oVf4qoHvzS9vA3Cdp7r5fQ3yHo0NErwi8ZwRPUwmfKuwf4hm5h7ex0MA7f1r+Zfh4jFoOEppq25Wsg7m5xdu13Ps0kwjGJKY3pYgBt+8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=jRY3nsdv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="jRY3nsdv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7BBA41F00AC4; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=k/baGZCUSKTzBza5ql3ErF5JEkelRWpPcwn6SCdc9YA=; h=Date:From:To:Cc:Subject:References; b=jRY3nsdv8UPHHRVBCZrIwv+Qofujgmxzypzm5cJqwjKh/BScUnzlEIkID3pytee+/ wPEkqf7L3LVpngS1pD9RuO/uio8bLst+IqGw9RdkE6uo66nBkY9/XkS5JuwI+FR+Wi YuZX6kWlWn5mvX6fe7vXpZY3tZN6WsRrX5XOptFJ4Xn4DCkdPxqNofu7BiY6c+2jJG 6ipF/D9TpDGvJUqMBiEbXY1GQblIiyrm9vuijYPtOKY6zXpPbSE3TXuBXc1LA/J7yE a1EcjPqU1bLRxtk32FKDxyaNeXqtoVYpfPwbZwGkvJjW0mdQtgABYX+3ho9vH2I7WN xo1l+1ZPdYpKw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046tS-1fpe; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231856.251436050@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:45 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org Subject: [for-linus][PATCH 5/9] tracing: Fix union collision of module and refcnt for dynamic events References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Masami Hiramatsu (Google)" In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member is 'refcnt', which acts as an active reference counter. When a dynamic event (such as kprobe, uprobe, fprobe, eprobe, or wprobe) has a non-zero reference count (e.g. due to active event triggers or perf attachments), its 'call->module' evaluates to a small non-zero integer instead of NULL. When filtering or setting events for a specific module (e.g., writing ':mod:' to 'set_event'), the code in '__ftrace_set_clr_event_nolock()' and 'update_event_fields()' reads 'call->module' directly without checking whether the event is dynamic. This causes the kernel to treat the small integer (refcnt) as a 'struct module' pointer, leading to a NULL/invalid pointer dereference (Oops) when dereferencing the module name. Fix this by ensuring that the 'TRACE_EVENT_FL_DYNAMIC' flag is checked before treating 'call->module' as a valid pointer in these code paths. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/178425670947.84440.11344393611899824907.stgi= t@devnote2 Fixes: 4c86bc531e60 ("tracing: Add :mod: command to enabled module events") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index c46e623e7e0d..956692856fa8 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1350,7 +1350,9 @@ __ftrace_set_clr_event_nolock(struct trace_array *tr,= const char *match, call =3D file->event_call; =20 /* If a module is specified, skip events that are not that module */ - if (module && (!call->module || strcmp(module_name(call->module), module= ))) + if (module && + ((call->flags & TRACE_EVENT_FL_DYNAMIC) || + !call->module || strcmp(module_name(call->module), module))) continue; =20 name =3D trace_event_name(call); --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D6594756C9; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; cv=none; b=iD4LtPw1qSloUqyvj7wq7RrEgwaFmClY/RQU4UZbJ1pzvrWAPkE5xyvKt2vlVMzmvOXrfH3aq4Ea1CCYhq2ymnVFT7hsW1agsqAEa5G+r3Np6FxWsxmc3PuZWtoA2iDRzYUE5XQNHV8eCAW2BSjYkt69xXbFa0uURucn9au7cdg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; c=relaxed/simple; bh=NmptBfjJ5/i16Abhx8EVMEBRg//W5xU3cpfWiq649iI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=t9YRpuytlqH2SlmxBJCq0KGUbcyuobCAgm+xVPwOcGCJsb394pByMGq9pSmMYtQE8ISGkDX6304t5+D/cl7JK+xggm/aTIprjxNMQxWasCfOtqpnYaF1Oy+MnmeKn0MfClY4pgIVtOzwtsinNW1lrgU2LLm2RzJ3HMGkQgiftwQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KV6puP4C; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KV6puP4C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5D0C1F00ACF; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=cyB4fSlwRh7NlIQlttoqX2onDg019zsiXwHC97/VDfc=; h=Date:From:To:Cc:Subject:References; b=KV6puP4CbQLNEHJI8+H9unHOm7nQKiJH1oDRhNDk7sI8smF+C5jBYcaANxYXUJuyh nOH2Xz1eSscKik+KoM2+lzbzDIsIkGLC6hw7x2yJRG1cbTwv0vfni1dJXiVfaodNxZ k8gD8OmLpGghJ9VKQFwaln+RCo/jeFxb55tFEoxMfZ59ULvV4weUinhAMLIMJKjvO4 f1a32LgVnZkxbBjxFJS3z7SGQYlyIjQ0Bk6ry6elFmDG5MGTRxRGvzs+o+NGFXNFRv JKhs/8fno0EfiMYxUmDblxhsZqXrlKPFIMnsMONk4eYm40ODvFHmYKxAa712HPL8DE TuVoMe8Wjy3aA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046tw-2JVF; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231856.417111063@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:46 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org Subject: [for-linus][PATCH 6/9] selftests/ftrace: Reset triggers at top level before instance loop References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Masami Hiramatsu (Google)" When running instance tests, 'ftracetest' creates a new ftrace instance and runs the tests inside it. Before starting each test, it executes 'initialize_system()' to reset the ftrace state to initial-state. However, since 'initialize_system()' is executed in the context of the instance directory, it only cleans up triggers and filters of that instance. Any triggers or dynamic events left behind in the top-level instance by previous failed top-level tests, are left completely untouched. These top-level leftovers can cause subsequent instance-based tests to fail or even crash the kernel. Fix this by executing 'initialize_system()' in the top-level tracing directory once before entering the instance loop. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/178425671889.84440.9477850701738666404.stgit= @devnote2 Fixes: b5b77be812de ("selftests: ftrace: Allow some tests to be run in a tr= acing instance") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- tools/testing/selftests/ftrace/ftracetest | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/self= tests/ftrace/ftracetest index 0a56bf209f6c..8ad2c385407e 100755 --- a/tools/testing/selftests/ftrace/ftracetest +++ b/tools/testing/selftests/ftrace/ftracetest @@ -503,6 +503,7 @@ for t in $TEST_CASES; do done =20 # Test on instance loop +(cd $TRACING_DIR; initialize_system) INSTANCE=3D" (instance) " for t in $TEST_CASES; do test_on_instance $t || continue --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D5A93C2BBA; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935113; cv=none; b=aF8MYuWRIbPsrMAdbs/o78YMonlRrE24eKu7VHYRU7J49R1zz9+r4bNWbUdhExT6kJGNN1vYMUMWhQsCso830FixHJhv/gYRJ396IhofZUx9wlC9dZJmoKdw6xdYEIGwebmh8Txyo4eE+ElgpNGA38YUB0rU+tLfEqI1DgYhRlE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935113; c=relaxed/simple; bh=81EnjqOBGcZ0Bs8bYt5pmiKrJQ91CTx/v1DYPo9Zmao=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Zf83M5nW30Za5ejsXR25BXZxL0wleF6E4qWAPGizzcUQ3nFNaH8HSLeqFsLITwRPdJ3yK8k9YpgBUrlZsSad0cVGurfIYtvm4vKOr40gCjdoLz3cXCbHCNQMyYDBgxLNorPKvDJVr/d/qYejbpdgcDfVveISag2ksGlm3AjcW5Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=H47wRvWO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="H47wRvWO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D30FD1F00ACA; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935110; bh=CDst2w1T+OL9OaGT2HgGNFKnrThWQX6AMrH4F2eOtzI=; h=Date:From:To:Cc:Subject:References; b=H47wRvWOlRfChkZPYkuLGdjNiei8nzfZl/EF3sxefteYulKJHxbTa53JwoT3tsOnl LquzKG4s0akEzddFc1FfaxTJczmgSYEgpf03cB5cofJLx1z18inJglCpdVjD+js1Me HswOYOik/CcyDWQoqoRYic5wqb+iEojEWMzlLRKhzLcQAs7SEtVk3RfDn9bKCR6WWf baGZ+1PIt4TCml2kNOByQpiaQZYOlm1mm9kio0iPzdXnAAkG2nlvfXBgbL8bHySvSO bnXX2wPuOIDvkIzRcPF/tp6DU8I2DkxkrrvfRV8uopExdFHy0hb+LT4vggoCAHhvzy KWDHp+Pi2izDQ== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046uS-30Ls; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231856.572531317@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:47 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Breno Leitao , Usama Arif Subject: [for-linus][PATCH 7/9] tracing: Fix context switch counter truncation References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Usama Arif trace_user_fault_read() samples nr_context_switches_cpu() before enabling preemption and retries the user copy if the counter changes. The helper returns unsigned long long because rq->nr_switches is u64, but the saved value is unsigned int. Once a CPU has performed 2^32 context switches, assigning the counter to cnt discards its upper bits. The comparison after the copy promotes cnt back to unsigned long long, but the lost bits remain zero, so it reports a change even when the task was never scheduled out. Every retry then fails the same way until the 100-try guard warns and the user copy is abandoned. This affects long-running systems and workloads with high context-switch rates. A CPU switching 1,000 times per second takes about 50 days. Store the sampled count in unsigned long long so the full value is preserved. Cc: stable@vger.kernel.org Fixes: 64cf7d058a00 ("tracing: Have trace_marker use per-cpu data to read u= ser space") Link: https://patch.msgid.link/20260717173252.3431565-1-usama.arif@linux.dev Reported-by: Breno Leitao Signed-off-by: Usama Arif Acked-by: Masami Hiramatsu (Google) Reviewed-by: Breno Leitao Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 18710c190c92..01a5e87af299 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -6187,7 +6187,7 @@ char *trace_user_fault_read(struct trace_user_buf_inf= o *tinfo, { int cpu =3D smp_processor_id(); char *buffer =3D per_cpu_ptr(tinfo->tbuf, cpu)->buf; - unsigned int cnt; + unsigned long long cnt; int trys =3D 0; int ret; =20 --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63C424756C7 for ; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; cv=none; b=dojky4KW39+bgWyaFE+FFFFtfJxIXpY1gWqGTPSe/BTI3ZqYFdNqdIqkerXR7mbKVLaDPdA7J3qXaGETYB5BJU5NpBtBH2oivj5IMOzASwSST52FM6Oa7Hax8Gmu/bNhfyVdk/HbMjZJnNSGKGQHjQ2/HARvhggqo/hW5MHZpTw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935112; c=relaxed/simple; bh=5sdpT7+wjXgVGTqUvv9YQjilTkPTWIbE7TgANr9yq+k=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=GtuMA8MQp9aNMuctvaGoEx77x6RUwg25P7N7hW25gyx3bJVNSdhlJ4rKzRWZZFC0m73eMpWaFO5xvDRYN6+veRfyR7FwJF9DFIDZvL7SKS7hYELLZNHAGM0DVdhroLABGxSeoEF+21iJ8oI6OqUK4M7msfXIMZSR4VTba0OazXY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JhPPIJZf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JhPPIJZf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1B9A1F00ADE; Fri, 24 Jul 2026 23:18:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935111; bh=bbtd+mJ36eIFC1M+9gPgyYNJFC0aVjc75lZ3xi/+n1A=; h=Date:From:To:Cc:Subject:References; b=JhPPIJZf+7f0cun+gH3K1vAOxBv/wZQNsuwPQ780vaFZClwxZOGjSnA2be2Urgl5w OdmFyeZni+TbQt075z/sUz0TKP0EhO+Wu93QPiaQ85sIp/IzSncJN1NrmznSr6GkrX ULDhbTUVOhUeLMegJOam4PZgCudJcQUF8olb1IVBAY/Ux3xFzr5pA26HDb50l95soH ROu3aZHPBDPqEwwG664uUwgl7Wdc209L6hxiZlDVB+4D/xCP3RBsagPsJ4H/iz2YDL WvSI00D7y8aIudSEhJMRw8SmAzjeuW8sWVeDQrQ75Ev7Fg2s3fP8mRFr4MIREyc1nl 96RZH0N58OGQw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAO-000000046uw-3cNP; Fri, 24 Jul 2026 19:18:56 -0400 Message-ID: <20260724231856.733267183@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:48 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , David Carlier Subject: [for-linus][PATCH 8/9] tracing: Fix use-after-free freeing trigger private data References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: David Carlier Commit 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data") moved the kfree() of event_trigger_data to a kthread that runs tracepoint_synchronize_unregister() before freeing. That removed the synchronization the trigger .free callbacks used to get implicitly and inline from trigger_data_free(). event_hist_trigger_free(), event_hist_trigger_named_free() and event_enable_trigger_free() free their satellite data (hist_data, cmd_ops, enable_data) right after trigger_data_free() returns. With the synchronization now deferred to the kthread, a concurrent tracepoint handler can still reach that data through the list_del_rcu()'d trigger, causing a use-after-free. The histogram teardown must stay synchronous: remove_hist_vars() and unregister_field_var_hists() have to detach a synthetic event from the histogram before the trigger-removal write returns, otherwise a following command races in and the synthetic-event removal fails with -EBUSY, as the trigger-synthetic-eprobe.tc selftest catches. Make those callbacks wait with the correct barrier - tracepoint_synchronize_unregister(), matching the free kthread - before freeing. The enable trigger has no such synchronous requirement, and a blocking synchronize there would re-serialize the path that commit deliberately deferred. Give it an optional private_data_free() callback that the free kthread runs after its grace period, and free enable_data from there. Link: https://patch.msgid.link/20260724030523.19081-1-devnexen@gmail.com Suggested-by: Masami Hiramatsu (Google) Suggested-by: Steven Rostedt Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event= _trigger_data") Signed-off-by: David Carlier Signed-off-by: Steven Rostedt --- kernel/trace/trace.h | 1 + kernel/trace/trace_events_hist.c | 2 ++ kernel/trace/trace_events_trigger.c | 18 +++++++++++++++--- 3 files changed, 18 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 80fe152af1dd..bf77331f56a4 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1941,6 +1941,7 @@ struct event_trigger_data { struct list_head named_list; struct event_trigger_data *named_data; struct llist_node llist; + void (*private_data_free)(struct event_trigger_data *data); }; =20 /* Avoid typos */ diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 82ce492ab268..58d28cd1afa3 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6349,6 +6349,7 @@ static void event_hist_trigger_free(struct event_trig= ger_data *data) =20 trigger_data_free(data); =20 + tracepoint_synchronize_unregister(); remove_hist_vars(hist_data); =20 unregister_field_var_hists(hist_data); @@ -6388,6 +6389,7 @@ static void event_hist_trigger_named_free(struct even= t_trigger_data *data) =20 del_named_trigger(data); trigger_data_free(data); + tracepoint_synchronize_unregister(); kfree(cmd_ops); } } diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_event= s_trigger.c index 655db2e82513..46e60b70a4bb 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -38,6 +38,13 @@ static void trigger_create_kthread_locked(void) } } =20 +static void trigger_data_free_one(struct event_trigger_data *data) +{ + if (data->private_data_free) + data->private_data_free(data); + kfree(data); +} + static void trigger_data_free_queued_locked(void) { struct event_trigger_data *data, *tmp; @@ -52,7 +59,7 @@ static void trigger_data_free_queued_locked(void) tracepoint_synchronize_unregister(); =20 llist_for_each_entry_safe(data, tmp, llnodes, llist) - kfree(data); + trigger_data_free_one(data); } =20 /* Bulk garbage collection of event_trigger_data elements */ @@ -75,7 +82,7 @@ static int trigger_kthread_fn(void *ignore) tracepoint_synchronize_unregister(); =20 llist_for_each_entry_safe(data, tmp, llnodes, llist) - kfree(data); + trigger_data_free_one(data); } =20 return 0; @@ -1717,6 +1724,11 @@ int event_enable_trigger_print(struct seq_file *m, return 0; } =20 +static void enable_trigger_private_data_free(struct event_trigger_data *da= ta) +{ + kfree(data->private_data); +} + void event_enable_trigger_free(struct event_trigger_data *data) { struct enable_trigger_data *enable_data =3D data->private_data; @@ -1728,9 +1740,9 @@ void event_enable_trigger_free(struct event_trigger_d= ata *data) if (!data->ref) { /* Remove the SOFT_MODE flag */ trace_event_enable_disable(enable_data->file, 0, 1); + data->private_data_free =3D enable_trigger_private_data_free; trace_event_put_ref(enable_data->file->event_call); trigger_data_free(data); - kfree(enable_data); } } =20 --=20 2.53.0 From nobody Sat Jul 25 22:31:39 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C4D947604A; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935113; cv=none; b=WdOoN8yyyVkqsswS7lFl+q4n3qGk41iqAwOon860QbmldJqyHhqPDsg1y0qh3bRCruPE5s+uOXQFgqMyDNUFNaTsbA0WyRL1AP8AnCoXnbPxPGlqv3E471chUUX4Dl+I7JxxP9Ay9s3hdbD/nV/GQQSvjaWwCePU1Jk+aCaJUjA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784935113; c=relaxed/simple; bh=Qll+//jgXXadWYprn+QPuI4SCLrd+jSg8/sUJmq5GuQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=jmmoR/HwF+Eq7k6dNKwC6RsiTu0CFz4WlbTE1aoP85dILmJJylkZ4UrqmjE3FN1P2Qd4m0UWypXzgDYBYDt7KrRVp9z4uInJo7Z+YKPRUu5nDWLrOuC/hnEDEyTEVVoTHEhE0bSJLCVxsXTGpdULNGYLGAgFAg0ZiDCkYNsp/1k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AX8SfgNG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AX8SfgNG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2865D1F00ADF; Fri, 24 Jul 2026 23:18:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784935111; bh=OJWcsF5hPHMB0NRQDfte1CFKDsA//x9f6tzD+Q9jzVI=; h=Date:From:To:Cc:Subject:References; b=AX8SfgNG1rrAaMIETZANRwsr079nYaAPaJrbO5Ak6h3NETRENU/oD01qL2uCnvcvm Bi+u35zZMSbbe+2Am3z8ajqiq60N6FZaJWU2iQFtGYRwb5nCi656mmdEVhRuQ8QnnW OOo3qI81NNO5vpQLRLRoyjbjzxE46cEOmOXPp24Mgn0y7bOYL7U51EgNw4LBEbDf8r RD2aDuonIa+y0Q9cC+hYU+CrbCzDDMyVUsCfDnc6JkuAQsz/hi7rX98nEUPllycgJp RGn6zNQVUTLx0lWvDeKspc50LEZ3e4SXA0Zbig5wijPaBBQx4aSEJovqjKVoOjnf4l /WexXL9zMhXEg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wnPAP-000000046vS-06K9; Fri, 24 Jul 2026 19:18:57 -0400 Message-ID: <20260724231856.879374418@kernel.org> User-Agent: quilt/0.69 Date: Fri, 24 Jul 2026 19:18:49 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Sashiko Subject: [for-linus][PATCH 9/9] tracing: Delay module ref count for "enable_event" trigger References: <20260724231840.483353969@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enable_event data is put into the private_data_free() callback, but the put of the module refcount is done immediately. It is possible that if a module is removed that has an event that would enable (or disable) it is still active, it can read the data of the module after it is removed causing a use-after-free bug. Move the trace_event_put_ref() that releases the module into the delayed callback so that the module can not be removed until any reference to its events are finished. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home Reported-by: Sashiko Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmai= l.com Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event= _trigger_data") Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_trigger.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_event= s_trigger.c index 46e60b70a4bb..ad83419cb420 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m, =20 static void enable_trigger_private_data_free(struct event_trigger_data *da= ta) { - kfree(data->private_data); + struct enable_trigger_data *enable_data =3D data->private_data; + + trace_event_put_ref(enable_data->file->event_call); + kfree(enable_data); } =20 void event_enable_trigger_free(struct event_trigger_data *data) @@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_d= ata *data) /* Remove the SOFT_MODE flag */ trace_event_enable_disable(enable_data->file, 0, 1); data->private_data_free =3D enable_trigger_private_data_free; - trace_event_put_ref(enable_data->file->event_call); trigger_data_free(data); } } --=20 2.53.0