Re: [BUG] tracing: use-after-free in t_start() when a trace instance is removed

[Steven Rostedt]

On Fri, 28 Aug 2026 09:23:57 -0400
Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:

> On Thu, 27 Aug 2026 20:28:59 -0400
> Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:
> 
> > I see what the problem is. I guess you were creating and removing trace
> > instances while reading available_events. All files that are part of an
> > instance needs to get a reference counter on the trace instance when
> > opened. This prevents the instance from being freed when there are
> > opened files in it. I see that the available_events file doesn't take
> > that reference which will allow its instance to be freed while another
> > task has its content opened. When it reads that content, it will
> > trigger the bug you see.  
> 
> It's not available_events, it's the two new files that were added that
> didn't take a reference:
> 
>   show_event_filters and show_event_triggers
> 
> This should fix it:
> 

I updated the selftests with this:

diff --git a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
index 42422e425107..1e3f27d6998b 100644
--- a/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
+++ b/tools/testing/selftests/ftrace/test.d/instances/instance-event.tc
@@ -43,6 +43,13 @@ instance_set() {
         done 2> /dev/null
 }
 
+instance_cat() {
+        while :; do
+                cat foo/show_event_filters
+                cat foo/show_event_triggers
+        done 2> /dev/null
+}
+
 instance_slam &
 p1=$!
 echo $p1
@@ -55,14 +62,19 @@ instance_read &
 p3=$!
 echo $p3
 
+instance_cat &
+p4=$!
+echo $p4
+
 sleep 1
 
+kill -1 $p4
 kill -1 $p3
 kill -1 $p2
 kill -1 $p1
 
 echo "Wait for processes to finish"
-wait $p1 $p2 $p3
+wait $p1 $p2 $p3 $p4
 echo "all processes finished, wait for cleanup"
 sleep 1
 


And it was also able to reproduce the issue. With the applied fix, it
doesn't trigger anymore. I'll write up a proper patch.

-- Steve