tracing: Don't dereference trace_event_file in deferred trigger free

The enable_event trigger defers trace_event_put_ref() to the
trigger free kthread, but the trace_event_file can already be freed
when the instance is removed.

Keep the trace_event_call directly in enable_trigger_data so the
deferred free does not access the freed trace_event_file.

Cc: stable@vger.kernel.org
Fixes: e091351b3881 ("tracing: Delay module ref count for "enable_event" trigger")
Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
Closes: https://lore.kernel.org/all/20260828134340.2501683A24-agordeev@linux.ibm.com/
Link: https://patch.msgid.link/20260911155650.354844-1-aliamemis@disroot.org
Signed-off-by: Ali Ahmet Memiş <aliamemis@disroot.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index bd3c8f80300f3bf57c90a71d7e06e0a369cda5db..3749485a7d85fd9d043c1dad5e969a93365d76f0 100644 (file)
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1953,6 +1953,7 @@ struct event_trigger_data {
 
 struct enable_trigger_data {
        struct trace_event_file         *file;
+       struct trace_event_call         *call;
        bool                            enable;
        bool                            hist;
 };

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 149300cc5e8ad9b72c37e610d91350796d3f3a58..4d2fde996c0f6c786a9bc25ae8605968a43cd677 100644 (file)
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1728,7 +1728,8 @@ static void enable_trigger_private_data_free(struct event_trigger_data *data)
 {
        struct enable_trigger_data *enable_data = data->private_data;
 
-       trace_event_put_ref(enable_data->file->event_call);
+       /* The file may already be freed here, only the call is kept alive */
+       trace_event_put_ref(enable_data->call);
        kfree(enable_data);
 }
 
@@ -1801,6 +1802,7 @@ int event_enable_trigger_parse(struct event_command *cmd_ops,
        enable_data->hist = hist;
        enable_data->enable = enable;
        enable_data->file = event_enable_file;
+       enable_data->call = event_enable_file->event_call;
 
        trigger_data = trigger_data_alloc(cmd_ops, cmd, param, enable_data);
        if (!trigger_data)