[BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Farhad Alemi]

Hello Steven Rostedt, Masami Hiramatsu,

While fuzzing Linux 7.1-rc5 with syzkaller, as part of research at ASU's
SEFCOM lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/116-tracing-uaf-t_start-instance-rmdir/

  ==================================================================
  BUG: KASAN: slab-use-after-free in t_next
kernel/trace/trace_events.c:1568 [inline]
  BUG: KASAN: slab-use-after-free in t_start+0xcc/0x210
kernel/trace/trace_events.c:1592
  Read of size 8 at addr ffff888022f7a960 by task syz.4.116/12466
  CPU: 0 UID: 0 PID: 12466 Comm: syz.4.116 Not tainted 7.1.0-rc5 #1
PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Call Trace:
  <TASK>
  dump_stack_lvl+0x94/0xd0 lib/dump_stack.c:120

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,