Commit bcfe2816e6ec for kernel

commit bcfe2816e6ec46c3f4c58aa4264476665ddb3f69
Author: Ali Ahmet Memiş <aliamemis@disroot.org>
Date:   Fri Sep 11 18:56:47 2026 +0300

    tracing: Don't dereference trace_event_file in deferred trigger free

    The enable_event trigger defers trace_event_put_ref() to the
    trigger free kthread, but the trace_event_file can already be freed
    when the instance is removed.

    Keep the trace_event_call directly in enable_trigger_data so the
    deferred free does not access the freed trace_event_file.

    Cc: stable@vger.kernel.org
    Fixes: e091351b3881 ("tracing: Delay module ref count for "enable_event" trigger")
    Reported-by: Alexander Gordeev <agordeev@linux.ibm.com>
    Closes: https://lore.kernel.org/all/20260828134340.2501683A24-agordeev@linux.ibm.com/
    Link: https://patch.msgid.link/20260911155650.354844-1-aliamemis@disroot.org
    Signed-off-by: Ali Ahmet Memiş <aliamemis@disroot.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index bd3c8f80300f..3749485a7d85 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -1953,6 +1953,7 @@ struct event_trigger_data {

 struct enable_trigger_data {
 	struct trace_event_file		*file;
+	struct trace_event_call		*call;
 	bool				enable;
 	bool				hist;
 };
diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 149300cc5e8a..4d2fde996c0f 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1728,7 +1728,8 @@ static void enable_trigger_private_data_free(struct event_trigger_data *data)
 {
 	struct enable_trigger_data *enable_data = data->private_data;

-	trace_event_put_ref(enable_data->file->event_call);
+	/* The file may already be freed here, only the call is kept alive */
+	trace_event_put_ref(enable_data->call);
 	kfree(enable_data);
 }

@@ -1801,6 +1802,7 @@ int event_enable_trigger_parse(struct event_command *cmd_ops,
 	enable_data->hist = hist;
 	enable_data->enable = enable;
 	enable_data->file = event_enable_file;
+	enable_data->call = event_enable_file->event_call;

 	trigger_data = trigger_data_alloc(cmd_ops, cmd, param, enable_data);
 	if (!trigger_data)