On Tue, 1 Sep 2026 19:13:39 -0400
Steven Rostedt <[email protected]> wrote:
> > For example, if a user opens a per-instance tracing_max_latency file,
> > keeps the descriptor open, and the instance is removed, could a
> > subsequent write dereference the freed memory?
Not sure what tree you are looking at.
> >
> > kernel/trace/trace.c:tracing_max_lat_write() {
That function has been moved to trace_snapshot.c
> > ...
> > return tracing_nsecs_write(filp->private_data, ubuf, cnt, ppos);
> > }
> >
> > Where tracing_nsecs_write would perform an unlocked write to the
> > freed pointer?
and this has been fixed by:
7d660c9b2bc95 ("tracing: Have tracing_max_latency inc the trace array ref
count")
That was added in 2023.
-- Steve
