From nobody Sun Feb 8 20:59:02 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAA3C1ACE0C; Tue, 13 May 2025 15:50:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747151408; cv=none; b=Qvun8MlrsRpsk5sYpzHW90MHRACdO0+2btiY9w/9uza/hcy3FTtcJgerh8NACqOZeqqH+pL9NDNV4YeOhnCXRCyoWpJ8XI2Vl/LdnPfuntrg0gjFwaVvOscLRmrpv3NBbZTD7Bqx8S0wZp4aenaQnIFi8Kgrb8xYjeKapXmP+zA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747151408; c=relaxed/simple; bh=zKwFqYWMP6cuugdV9Ke6/xcQfhHjHZP9xRGohNCx+wE=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=k1W9gUoOokEq6rHsqvT1IXahZN9otgvdtujH4M9AX8bMZlf/v1UrnwgOKjVCItw7kV7ZOiSeZzSi6xQvnElQAevXweyOCKz18+1Ccyc4mild+9g+zYEjXw6sAi5cdMZ07gOdSsDo1KV2rGE6HTDxCJ5wYHfS4JSL1pwj42htOaA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 847D3C4CEE4; Tue, 13 May 2025 15:50:07 +0000 (UTC) Date: Tue, 13 May 2025 11:50:32 -0400 From: Steven Rostedt To: LKML , Linux Trace Kernel Cc: Masami Hiramatsu , Mathieu Desnoyers , Tasos Sahanidis Subject: [PATCH] ring-buffer: Fix persistent buffer when commit page is the reader page Message-ID: <20250513115032.3e0b97f7@gandalf.local.home> X-Mailer: Claws Mail 3.20.0git84 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" \From: Steven Rostedt The ring buffer is made up of sub buffers (sometimes called pages as they are by default PAGE_SIZE). It has the following "pages": "tail page" - this is the page that the next write will write to "head page" - this is the page that the reader will swap the reader page = with. "reader page" - This belongs to the reader, where it will swap the head page from the ring buffer so that the reader does not race with the writer. The writer may end up on the "reader page" if the ring buffer hasn't written more than one page, where the "tail page" and the "head page" are the same. The persistent ring buffer has meta data that points to where these pages exist so on reboot it can re-create the pointers to the cpu_buffer descriptor. But when the commit page is on the reader page, the logic is incorrect. The check to see if the commit page is on the reader page checked if the head page was the reader page, which would never happen, as the head page is always in the ring buffer. The correct check would be to test if the commit page is on the reader page. If that's the case, then it can exit out early as the commit page is only on the reader page when there's only one page of data in the buffer. There's no reason to iterate the ring buffer pages to find the "commit page" as it is already found. To trigger this bug: # echo 1 > /sys/kernel/tracing/instances/boot_mapped/events/syscalls/sys_= enter_fchownat/enable # touch /tmp/x # chown sshd /tmp/x # reboot On boot up, the dmesg will have: Ring buffer meta [0] is from previous boot! Ring buffer meta [1] is from previous boot! Ring buffer meta [2] is from previous boot! Ring buffer meta [3] is from previous boot! Ring buffer meta [4] commit page not found Ring buffer meta [5] is from previous boot! Ring buffer meta [6] is from previous boot! Ring buffer meta [7] is from previous boot! Where the buffer on CPU 4 had a "commit page not found" error and that buffer is cleared and reset causing the output to be empty and the data los= t. When it works correctly, it has: # cat /sys/kernel/tracing/instances/boot_mapped/trace_pipe <...>-1137 [004] ..... 998.205323: sys_enter_fchownat: __sysca= ll_nr=3D0x104 (260) dfd=3D0xffffff9c (4294967196) filename=3D(0xffffc90000a= 0002c) user=3D0x3e8 (1000) group=3D0xffffffff (4294967295) flag=3D0x0 (0 Cc: stable@vger.kernel.org Fixes: 5f3b6e839f3ce ("ring-buffer: Validate boot range memory events") Reported-by: Tasos Sahanidis Signed-off-by: Steven Rostedt (Google) Reviewed-by: Masami Hiramatsu (Google) Tested-by: Tasos Sahanidis --- kernel/trace/ring_buffer.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 1ca482955dae..6859008ca34d 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1887,10 +1887,12 @@ static void rb_meta_validate_events(struct ring_buf= fer_per_cpu *cpu_buffer) =20 head_page =3D cpu_buffer->head_page; =20 - /* If both the head and commit are on the reader_page then we are done. */ - if (head_page =3D=3D cpu_buffer->reader_page && - head_page =3D=3D cpu_buffer->commit_page) + /* If the commit_buffer is the reader page, update the commit page */ + if (meta->commit_buffer =3D=3D (unsigned long)cpu_buffer->reader_page->pa= ge) { + cpu_buffer->commit_page =3D cpu_buffer->reader_page; + /* Nothing more to do, the only page is the reader page */ goto done; + } =20 /* Iterate until finding the commit page */ for (i =3D 0; i < meta->nr_subbufs + 1; i++, rb_inc_page(&head_page)) { --=20 2.47.2