Commit 61e19cd2 authored by Sasha Levin's avatar Sasha Levin Committed by Steven Rostedt (Google)
Browse files

tracing: Fix lock imbalance in s_start() memory allocation failure path 

When s_start() fails to allocate memory for set_event_iter, it returns NULL
before acquiring event_mutex. However, the corresponding s_stop() function
always tries to unlock the mutex, causing a lock imbalance warning:

  WARNING: bad unlock balance detected!
  6.17.0-rc7-00175-g2b2e0c04f78c #7 Not tainted
  -------------------------------------
  syz.0.85611/376514 is trying to release lock (event_mutex) at:
  [<ffffffff8dafc7a4>] traverse.part.0.constprop.0+0x2c4/0x650 fs/seq_file.c:131
  but there are no more locks to release!

The issue was introduced by commit b355247d ("tracing: Cache ':mod:'
events for modules not loaded yet") which added the kzalloc() allocation before
the mutex lock, creating a path where s_start() could return without locking
the mutex while s_stop() would still try to unlock it.

Fix this by unconditionally acquiring the mutex immediately after allocation,
regardless of whether the allocation succeeded.

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/20250929113238.3722055-1-sashal@kernel.org


Fixes: b355247d ("tracing: Cache ":mod:" events for modules not loaded yet")
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent 2378a191

kernel/trace/trace_events.c

+1 −2
Original line number Diff line number Diff line
@@ -1629,11 +1629,10 @@ static void *s_start(struct seq_file *m, loff_t *pos) 
	loff_t l;



	iter = kzalloc(sizeof(*iter), GFP_KERNEL);

	mutex_lock(&event_mutex);

	if (!iter)

		return NULL;



	mutex_lock(&event_mutex);



	iter->type = SET_EVENT_FILE;

	iter->file = list_entry(&tr->events, struct trace_event_file, list);