Commit e091351b3881 for kernel

commit e091351b38818ef620d27f44f4bfd625f13afbff
Author: Steven Rostedt <rostedt@goodmis.org>
Date:   Fri Jul 24 13:24:15 2026 -0400

    tracing: Delay module ref count for "enable_event" trigger

    Triggers are now delayed from freeing, but can still be triggered until
    after the RCU grace period has ended. The freeing of the enable_event data
    is put into the private_data_free() callback, but the put of the module
    refcount is done immediately.

    It is possible that if a module is removed that has an event that would
    enable (or disable) it is still active, it can read the data of the module
    after it is removed causing a use-after-free bug.

    Move the trace_event_put_ref() that releases the module into the delayed
    callback so that the module can not be removed until any reference to its
    events are finished.

    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20260724132415.1b5005db@gandalf.local.home
    Reported-by: Sashiko <sashiko-bot@kernel.org>
    Link: https://sashiko.dev/#/patchset/20260724030523.19081-1-devnexen%40gmail.com
    Fixes: 61d445af0a7c ("tracing: Add bulk garbage collection of freeing event_trigger_data")
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 46e60b70a4bb..ad83419cb420 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1726,7 +1726,10 @@ int event_enable_trigger_print(struct seq_file *m,

 static void enable_trigger_private_data_free(struct event_trigger_data *data)
 {
-	kfree(data->private_data);
+	struct enable_trigger_data *enable_data = data->private_data;
+
+	trace_event_put_ref(enable_data->file->event_call);
+	kfree(enable_data);
 }

 void event_enable_trigger_free(struct event_trigger_data *data)
@@ -1741,7 +1744,6 @@ void event_enable_trigger_free(struct event_trigger_data *data)
 		/* Remove the SOFT_MODE flag */
 		trace_event_enable_disable(enable_data->file, 0, 1);
 		data->private_data_free = enable_trigger_private_data_free;
-		trace_event_put_ref(enable_data->file->event_call);
 		trigger_data_free(data);
 	}
 }