On Fri, Oct 09, 2026 at 10:05:56PM +0530, Amit Machhiwal wrote: > If trace buffer allocation fails during early boot (e.g. in > early_trace_init() -> allocate_trace_buffers()), tracing_disabled is > left set to 1 and the global trace array events list remains > uninitialized. > > Later during boot, tracer_init_tracefs() (invoked via fs_initcall) > queues tracerfs_init_work asynchronously without checking if tracing was > disabled. When tracer_init_tracefs_work_func() runs, it calls > event_trace_init() and init_tracer_tracefs(&global_trace, NULL) > unconditionally. This leads to __find_event_file() dereferencing an > uninitialized tr->events list, causing an early boot NULL pointer > dereference Oops: > > BUG: Kernel NULL pointer dereference on read at 0x00000010 > Faulting instruction address: 0xc000000000485be0 > Oops: Kernel access of bad area, sig: 7 [#1] > ... > NIP [c000000000485be0] __find_event_file+0x70/0x3c0 > LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 > Call Trace: > init_tracer_tracefs+0x274/0xc80 > tracer_init_tracefs_work_func+0x50/0x320 > process_one_work+0x1e8/0x5c0 > worker_thread+0x1dc/0x3d0 > kthread+0x194/0x1b0 > start_kernel_thread+0x14/0x18 > > Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() > and return immediately if tracing is disabled or failed to initialize, > preventing the crash.
Thanks for the patch Tested-by: Michal Suchánek <[email protected]> > > Fixes: 6621a7004684 ("tracing: make tracer_init_tracefs initcall > asynchronous") > Cc: [email protected] > Reported-by: Michal Suchánek <[email protected]> > Closes: https://lore.kernel.org/all/[email protected]/ > Signed-off-by: Amit Machhiwal <[email protected]> > --- > kernel/trace/trace.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c > index e4a490d3d08c..7ac9e1c92702 100644 > --- a/kernel/trace/trace.c > +++ b/kernel/trace/trace.c > @@ -9287,6 +9287,12 @@ static struct notifier_block trace_module_nb = { > > static __init void tracer_init_tracefs_work_func(struct work_struct *work) > { > + /* > + * Do not attempt to initialize tracefs if tracing was disabled or > + * failed to allocate > + */ > + if (tracing_disabled) > + return; > > event_trace_init(); > > -- > 2.54.0 (Apple Git-157) >
