From 66877a312ae3c2c3d849e82e882f642ffd4ec3e2 Mon Sep 17 00:00:00 2001 From: David Carlier Date: Fri, 16 Oct 2026 07:16:34 +0100 Subject: [PATCH] tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array. Cc: stable@vger.kernel.org Fixes: 5f3719f697c3 ("tracing: Update modules to persistent instances when loaded") Link: https://patch.msgid.link/20261016061638.214847-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 48ecc4bb55e4..96005a930b25 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9244,6 +9244,8 @@ static void trace_module_record(struct module *mod, bool add) struct trace_array *tr; unsigned long flags; + guard(mutex)(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { flags = tr->flags & (TRACE_ARRAY_FL_BOOT | TRACE_ARRAY_FL_LAST_BOOT); /* Update any persistent trace array that has already been started */