Re: [BUG] tracing: use-after-free in t_start() when a trace instance is removed

On Fri, 28 Aug 2026 09:23:57 -0400
Steven Rostedt [off-list ref] wrote:

On Thu, 27 Aug 2026 20:28:59 -0400
Steven Rostedt [off-list ref] wrote:

quoted

I see what the problem is. I guess you were creating and removing trace
instances while reading available_events. All files that are part of an
instance needs to get a reference counter on the trace instance when
opened. This prevents the instance from being freed when there are
opened files in it. I see that the available_events file doesn't take
that reference which will allow its instance to be freed while another
task has its content opened. When it reads that content, it will
trigger the bug you see.  

It's not available_events, it's the two new files that were added that
didn't take a reference:

  show_event_filters and show_event_triggers

This should fix it:

I updated the selftests with this:

diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
index 42422e425107..1e3f27d6998b 100644
--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc

@@ -43,6 +43,13 @@ instance_set() {
         done 2> /dev/null
 }
 
+instance_cat() {
+        while :; do
+                cat foo/show_event_filters
+                cat foo/show_event_triggers
+        done 2> /dev/null
+}
+
 instance_slam &
 p1=$!
 echo $p1

@@ -55,14 +62,19 @@ instance_read &
 p3=$!
 echo $p3
 
+instance_cat &
+p4=$!
+echo $p4
+
 sleep 1
 
+kill -1 $p4
 kill -1 $p3
 kill -1 $p2
 kill -1 $p1
 
 echo "Wait for processes to finish"
-wait $p1 $p2 $p3
+wait $p1 $p2 $p3 $p4
 echo "all processes finished, wait for cleanup"
 sleep 1
 

And it was also able to reproduce the issue. With the applied fix, it
doesn't trigger anymore. I'll write up a proper patch.

-- Steve