[v6.1] WARNING in tracepoint_probe_unregister

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11ccc079580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=229e728ebb8d6bd9e216
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7cd9b1875376/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4b5d35d18c31/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d5ee64c2af77/Image-e4f7d8be.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+229e72...@syzkaller.appspotmail.com

EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none.
overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore
overlayfs: at least 2 lowerdir are needed while upperdir nonexistent
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6216 at kernel/tracepoint.c:406 func_remove kernel/tracepoint.c:-1 [inline]
WARNING: CPU: 0 PID: 6216 at kernel/tracepoint.c:406 tracepoint_remove_func kernel/tracepoint.c:405 [inline]
WARNING: CPU: 0 PID: 6216 at kernel/tracepoint.c:406 tracepoint_probe_unregister+0x194/0x7c4 kernel/tracepoint.c:553
Modules linked in:
CPU: 0 PID: 6216 Comm: syz.2.467 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : tracepoint_remove_func kernel/tracepoint.c:-1 [inline]
pc : tracepoint_probe_unregister+0x194/0x7c4 kernel/tracepoint.c:553
lr : func_remove kernel/tracepoint.c:240 [inline]
lr : tracepoint_remove_func kernel/tracepoint.c:405 [inline]
lr : tracepoint_probe_unregister+0x190/0x7c4 kernel/tracepoint.c:553
sp : ffff8000213f7610
x29: ffff8000213f7640 x28: 1ffff00002fabf31 x27: dfff800000000000
x26: ffff800017d5f988 x25: ffff80001559ce88 x24: ffff800017d5f948
x23: ffff800008514cbc x22: 1fffe00018006e09 x21: ffff0000c0037048
x20: ffff0000c0037000 x19: fffffffffffffffe x18: 1fffe00033e7277e
x17: ffff80001537d000 x16: ffff8000082dbd3c x15: 0000000040000000
x14: 0000000000000001 x13: 1fffe00033e74e70 x12: 0000000000080000
x11: 000000000007ffff x10: ffff80002995c000 x9 : ffff8000084ca134
x8 : 0000000000080000 x7 : ffff80000825ab50 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
func_remove kernel/tracepoint.c:-1 [inline]
tracepoint_remove_func kernel/tracepoint.c:405 [inline]
tracepoint_probe_unregister+0x194/0x7c4 kernel/tracepoint.c:553
unregister_trace_sched_switch include/trace/events/sched.h:222 [inline]
tracing_sched_unregister kernel/trace/trace_sched_switch.c:86 [inline]
tracing_stop_sched_switch kernel/trace/trace_sched_switch.c:128 [inline]
tracing_stop_cmdline_record+0x88/0xd4 kernel/trace/trace_sched_switch.c:139
__ftrace_event_enable_disable+0x488/0x8cc kernel/trace/trace_events.c:779
ftrace_event_enable_disable kernel/trace/trace_events.c:866 [inline]
ftrace_clear_events kernel/trace/trace_events.c:875 [inline]
ftrace_event_set_open+0x128/0x264 kernel/trace/trace_events.c:2367
do_dentry_open+0x738/0xf8c fs/open.c:882
vfs_open+0x7c/0x90 fs/open.c:1015
do_open fs/namei.c:3634 [inline]
path_openat+0x1fc0/0x27a0 fs/namei.c:3791
do_filp_open+0x198/0x38c fs/namei.c:3818
do_sys_openat2+0x134/0x3fc fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__arm64_sys_openat+0x11c/0x150 fs/open.c:1347
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x200/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 45962
hardirqs last enabled at (45961): [<ffff80000825abe4>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1374 [inline]
hardirqs last enabled at (45961): [<ffff80000825abe4>] finish_lock_switch+0xb0/0x1c8 kernel/sched/core.c:5005
hardirqs last disabled at (45962): [<ffff800011b8c2bc>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last enabled at (42962): [<ffff8000081ae3bc>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last enabled at (42962): [<ffff8000081ae3bc>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (42829): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup