On Thu, Oct 22, 2026 at 06:52:48PM +0000, [email protected] wrote: > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) > to consider: > - [Medium] module: trace_module_put() records pre-decrement refcnt in > module_put() > -- > > commit 2c168275e42fc7a4482d549cb0c9f1fc9f71e395 > Author: Aaron Tomlin <[email protected]> > > module: Fix use-after-free in module_put() tracepoint > > This commit moves trace_module_put() before atomic_dec_if_positive() in > module_put() to prevent a use-after-free if the thread is preempted after > decrementing the module reference count while the module is being unloaded. > > > diff --git a/kernel/module/main.c b/kernel/module/main.c > > index f1392c10907a2..70063fea52d03 100644 > > --- a/kernel/module/main.c > > +++ b/kernel/module/main.c > > @@ -954,9 +954,9 @@ void module_put(struct module *module) > > int ret; > > > > if (module) { > > + trace_module_put(module, _RET_IP_); > > ret = atomic_dec_if_positive(&module->refcnt); > > WARN_ON(ret < 0); /* Failed to put refcount */ > > - trace_module_put(module, _RET_IP_); > > [Severity: Medium] > Does moving trace_module_put() before atomic_dec_if_positive() in > module_put() cause the module_put trace event to record a reference count > that is off by one?
Yes, moving trace_module_put() prior to atomic_dec_if_positive() means it records the pre-decrement reference count rather than the post-decrement count. Introducing unconditional RCU read-side locks on every call across the kernel solely to keep an inactive debug tracepoint post-decrement introduces unnecessary overhead. Relocating the tracepoint compiles down to a zero-overhead static jump label when tracing is disabled. -- Aaron Tomlin
