trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array. Fixes: 5f3719f697c3 ("tracing: Update modules to persistent instances when loaded") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e4a490d3d08c..d3ffbed9c44b 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9247,6 +9247,8 @@ static void trace_module_record(struct module *mod, bool add) struct trace_array *tr; unsigned long flags; + guard(mutex)(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { flags = tr->flags & (TRACE_ARRAY_FL_BOOT | TRACE_ARRAY_FL_LAST_BOOT); /* Update any persistent trace array that has already been started */ -- 2.55.0