[PATCH 0/2] tracing: Fix a kernel crash related to :mod: command

[Masami Hiramatsu (Google)]

Hi,

I found a kernel crash bug in tracing with :mod: command and dynamic
events. If we leaves a dynamic event and run :mod: command to set_event,
the kernel gets an oops.

Actually, this bug found by testing wprobe trigger test case, because
ftracetest has another bug which does not clean up the top-level event
filters/triggers before starting instance tests. Thus if the last test
case in the top-level instance fails and if it leaves a dynamic event,
that will be kept and not cleaned up. Then, test.d/event/event-mod.tc
hits this bug.

Here is the reproduce script.
-----
#!/bin/sh

TRACE_DIR="/sys/kernel/tracing"
if [ ! -d "$TRACE_DIR" ]; then
    TRACE_DIR="/sys/kernel/debug/tracing"
fi

if [ ! -d "$TRACE_DIR" ]; then
    echo "Error: Tracefs not found. Please mount tracefs."
    exit 1
fi

cd "$TRACE_DIR"

echo "=== 1. Clear existing triggers and dynamic events ==="
echo > events/sched/sched_process_fork/trigger || true
echo > dynamic_events || true

echo "=== 2. Create a kprobe event ==="
# Adding a kprobe on vfs_write
echo 'p:kprobes/my_kprobe vfs_write' >> dynamic_events
cat dynamic_events

echo "=== 3. Attach enable_event trigger targeting my_kprobe to sched_process_fork ==="
if [ -f "events/sched/sched_process_fork/trigger" ]; then
    echo 'enable_event:kprobes:my_kprobe' > events/sched/sched_process_fork/trigger
    cat events/sched/sched_process_fork/trigger
else
    echo "Error: sched_process_fork event trigger is not supported."
    exit 1
fi

echo "=== 4. Try to delete the kprobe event while the trigger is active ==="
echo "Attempting: echo -:kprobes/my_kprobe >> dynamic_events"
if ! echo '-:kprobes/my_kprobe' >> dynamic_events 2>/dev/null; then
    echo "Result: Successfully reproduced kprobe event deletion failure (Device or resource busy)!"
    echo "The 'my_kprobe' event remains in dynamic_events:"
    cat dynamic_events
else
    echo "Warning: Deletion succeeded? Check if the trigger was active."
fi

echo ""
echo "=== WARNING: The next step will crash the kernel if the union collision bug is not fixed! ==="
echo "Press Ctrl+C to stop now, or press Enter to trigger the kernel panic (via set_event ':mod:...' write)."
read tmp

echo "Triggering kernel panic..."
echo ':mod:trace-events-sample' > set_event
-----

Thanks,

---

Masami Hiramatsu (Google) (2):
      tracing: Fix union collision of module and refcnt for dynamic events
      selftests/ftrace: Reset triggers at top level before instance loop


 kernel/trace/trace_events.c               |    4 +++-
 tools/testing/selftests/ftrace/ftracetest |    1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

--
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>